App Signing Explained: iOS Certificates, Profiles and Android Keys
Basics4 minInnovialabs editorial team
In short
Signing proves an update comes from the same owner; on iOS Apple manages it through certificates and profiles, on Android the key point is never to lose the upload key, and all keys should sit in company-owned accounts, not with a contractor.
Why apps are signed
A signature is cryptographic proof of who built the app and that it has not been changed since. Stores and operating systems check it on every upload and install.
In practice this means three things:
- an update is accepted only if it is signed by the same owner as the previous version;
- nobody else can ship an "update" of your app;
- access to services (push notifications, Google sign-in, maps) is often tied to a specific signature.
That makes signing keys a business asset, just like a domain name or a bank account.
How it works on iOS
In Apple's ecosystem signing has several parts, all issued through the Apple Developer Program:
| Element | What it is | Why it matters |
|---|---|---|
| Certificate | A private key paired with a certificate issued by Apple | Proves a member of your team signed the build |
| App ID / Bundle ID | The app's unique identifier | Links signing, push and other capabilities to one app |
| Provisioning profile | A file tying together the certificate, the App ID and (for testing) a device list | Allows the build to be installed in a given mode |
There are several profile types: development, ad hoc (a limited list of devices), and App Store/TestFlight. Certificates and profiles expire and need to be renewed.
One important detail: apps in the App Store are re-signed by Apple itself. So if your distribution certificate expires or is revoked, the published app keeps working for users — you simply create a new certificate for future builds. Enterprise and ad hoc builds are different: an expired profile can stop the app from launching on employees' devices.
Also protect the push notification key (APNs, a .p8 file): Apple lets you download it only once.
How it works on Android
Google Play now uses Play App Signing with two keys:
- App signing key — the main key that signs what users actually install. Google stores it.
- Upload key — the key your team uses to sign the build (AAB) before uploading it to Play Console. You keep it.
You can create an upload key with the standard keytool utility from the JDK:
keytool -genkeypair -v -keystore upload-keystore.jks -keyalg RSA -keysize 2048 -validity 10000 -alias upload
The keystore file, its password, the alias and the key password are four things you must keep together.
What happens if a key is lost
| Situation | Consequence |
|---|---|
| iOS certificate lost | Revoke the old one, issue a new one. Users notice nothing |
| Android upload key lost with Play App Signing | The account owner requests an upload key reset in Play Console. Annoying but fixable |
| Android key lost without Play App Signing (older apps) | The app can no longer be updated. You have to publish a new one under a different package name and rebuild your audience |
| Developer account access lost | The worst case: no key helps without the account |
Who should hold the keys
The rule is simple: everything belongs to the company that owns the app, and contractors get access.
- Apple Developer and Google Play Console accounts are registered to the company; the contractor is added as a team member with the right role.
- The keystore and passwords live in a company password manager or secrets vault, with a backup stored separately.
- In CI/CD, keys are passed in as protected secrets, never stored in the repository.
- When you change contractors, you revoke their roles and the keys stay with you.
Common mistakes
- The keystore is committed to Git with passwords in plain text.
- The keys exist only on one developer's laptop.
- The store account is registered to a freelancer's personal email.
- Firebase, Google Maps or Google Sign-In are configured with the upload key fingerprint instead of the app signing key — and sign-in or maps break in the release build. The app signing key fingerprint is shown in Play Console.