Android Certificate: Generate, Sign And Verify An Apk App

Apk signing has been a part of Android from the beginning of the Android evolution, and android requires all Apks should be signed before it can be installed on the device, There have been numerous articles regarding on how to generate a key and also how to sign an Apk, but we will be looking at it from a Security Perspective, After you decompile or reverse-engineer an Apk file, What file should you look into, To get more info about the Developer who originally sign the app.

Looking At A Decompile APK File

After you unzip the file or using apktool, depending on how you decompile the file, if you unzip the file, The file structure will look like this.

\AndroidManifest.xml
\assets
\classes.dex
\lib
\META-INF
-alias_name.RSA
-alias_name.SF
-MANIFEST.MF
\res
\resources.arc

We are looking at the META-INF folder,
Looking at a decompile Apk using Apktool, It includes the certificates details about the developer and the type of hashing algorithm used and so on in the original folder and checking the META-INF folder.
Using keytool to check for the certificate while you are still currently in the META-INF folder.

$keytool -printcert -file DROIDRDR.RSA 

depending on the name of your certificate alias name, You will see different information of the Owner, Country, Issuer, Certificate Validity from both the date the certificate is issue and when the certificate is set to be expired.
Certificate fingerprints in MD5, SHA1 and SHA256 and also the Signature algorithm used.

Before, I talk about Generating a certificate, lets look at it from security perspective, In analyzing an Android application which you download from third party web site, You can decompile the App and look at the certificate and compare it with the original App, Look at the hashing algorithm used, compare it if probably the application has been modified or tamper with, I wont be talking about analyzing an APK file but may be later.

Generating An Android Certificate

If you decompile your android application and compile it back, You will need to sign the app, and if you don’t sign it the Application wont be installed on the user device. There are different ways of generating a certificate but, we will look at three ways to generate a certificate using keytool.

Method 1:

Open your terminal:

$keytool -genkey -v -keystore awwal -alias hafsa -keyalg RSA -keysize 2048 -validity 365

where awwal — is the keystore name, alias — hafsa is the certificate alias name, which after you use it will be added to META-INF folder, -keysize 2048 , but you can use 4096 size, but there are issues regarding that from devices or so. but just use 2048, validity is in days.

Method 2:

Using apk-signer.jar which can be downloaded here https://shatter-box.com/knowledgebase/android-apk-signing-tool-apk-signer/
This is a GUI written in Java that allows generating a certificate and also signing an apk file. Though there’s also an Android App for that in Playstore.

apk-signer

Method 3:

I created a bash script that automate the task of using method 1, As method might require you installing Java Runtime, Just run the script i created which uses keytool and jarsigner.
Download the script here: https://github.com/ShehuAwwal/Apk-Signer

apk-signer.sh by Shehu Awwal

After that follow the instruction which will be prompted to generate your key.

Signing An Android Applicaiton

After you already generate your android application, we will look at how to sign the app, run your terminal:

awwal@shehu:~$ jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore awwal medium.apk hafsa

Where -sigalg is the signature algorithm used, You can find some Apps using MD5 but use SHA1 as when you are verifying the app it will tell you the hashing algorithm used and how weak the algorithm used is.
keystore — awwal is the name of the keystore name used when generating the certificate, and hafsa is the alias name of the certificate, and medium.apk is the name of the app to be sign.
Note: if you MD5 the application will be treated as an unsign app because the algorithm use to sign the App is weak.

And the easier way is to use the Apk-signer.sh which i wrote to make the task easier.
Run the script, and press 2 for signing the app, Also completes also work there for file name and certificate name.

Or also you can make use of the apk-signer.jar also provide the options to sign the app.

Verifying An Android Application

Verify the app using jarsigner, to see the list of resources sign, the hashing algorithm with keysize.
Open your terminal:

awwal@shehu:~$ jarsigner -verify -verbose medium.apk

where verify only will show either it is sign or unsign and using the verbose options to see the full details of the certificate.
Or you can use Apk-signer to verify the App with auto completion of file name.