Question

I am developing an Android application which is going to be published at Android Market once everything is done. On the Android website, it says that when preparing the application for release, the certificate must be change from the debug certificate generated by Eclipse to the release key which can be self-signed by the developer.

My question is if the application is going to be published in the end, is it okay to just use the release key even if the application is under development? Anyway, the release key is the one going to be used in the end. So why not use the release key from the beginning?

Answer 1

So why not use the release key from the beginning?

I build in Eclipse before I go any further. There are a few reasons I can see:

• I work with code that has several iterations and prototypes I would not want to mistakenly publish them
• It is easier to work in Eclipse using the out of the box debug tool

From the documentation I can see that:

• Is in your possession
• Represents the personal, corporate, or organizational entity to be identified with the application
• Has a
  validity period that exceeds the expected lifespan of the application
  or application suite. A validity period of more than 25 years is
  recommended.
• If you plan to publish your application(s) on Android
  Market, note that a validity period ending after 22 October 2033 is a
  requirement. You can not upload an application if it is signed with a
  key whose validity expires before that date.
• Is not the debug key generated by the Android SDK tools.

From the above it becomes pretty clear that the key is something you have created that represents you. the automated debug certs will definitely not do this. Furthermore I do not know (and would be good to find out) if debug certs have the validity period required.

EDIT: example of how it identifies you via key tool command

-dname

This adds "A Distinguished Name that describes who created the key."