Why debug certificate is not safe to sign android APKs?

user_14134568 0
Viewed 234

Android Documents said that it's not safe to publish an app with a debug certificate, but I don't know why. What does "insecure by design" means, how the debug certificate is designed?

Because the debug certificate is created by the build tools and is insecure by design, most app stores (including the Google Play Store) do not accept apps signed with a debug certificate for publishing.

certificate cryptography android security
1 Answers

This page indicates that the problem is that the debug certificate does not have a trust anchor, so the certificate can easily be replaced. Here is the sample they present:

$ jarsigner -verify -verbose -certs example.apk

sm     11116 Fri Nov 11 12:07:48 ICT 2016 AndroidManifest.xml

      X.509, CN=Android Debug, O=Android, C=US
      [certificate is valid from 3/24/16 9:18 AM to 8/10/43 9:18 AM]
      [CertPath not validated: Path doesn\'t chain with any of the trust anchors]
(...)
user_12707890
Related