Is it OK to use same keystore for several apps?

Issue

When we want to publish our app to play store, we need to sign our app with keystore which can be generated via something like this:

keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000

So, it is OK to use the same keystore for several apps?

Solution

The Android developer site actually recommends signing all of your apps with the same certificate:

You should sign all of your apps with the same certificate throughout the expected lifespan of your applications. There are several reasons why you should do so:

• App upgrade: When the system is installing an update to an app, it compares the certificate(s) in the new version with those in the existing version. The system allows the update if the certificates match. If you sign the new version with a different certificate, you must assign a different package name to the application—in this case, the user installs the new version as a completely new application.

• App modularity: Android allows apps signed by the same certificate to run in the same process, if the applications so requests, so that the system treats them as a single application. In this way you can deploy your app in modules, and users can update each of the modules independently.

• Code/data sharing through permissions: Android provides signature-based permissions enforcement, so that an app can expose functionality to another app that is signed with a specified certificate. By signing multiple apps with the same certificate and using signature-based permissions checks, your apps can share code and data in a secure manner.

However, you should take this advice with a grain of salt. The first bullet point only applies to updated versions of a given app, not to multiple unrelated apps. The second and third bullet points are only relevant if you intend your different apps to work closely together as described.

Answered By - augurar