0

With regards to the certificate used for code signing for Android Marketplace, I realize that using a trusted third party to sign such a certificate is ... unlikely, for reasons that have been discussed. However an organization could create their own certificate authority, and sign the certificate that way.

My question is, would there be any advantage whatsoever to doing it this way? I get the impression that really the only thing that matters is the private key used to sign the code (and perhaps the expiration date) and that any other certificate information, such as chain of authority or CRL location is not utilized by the system in any way.

Thanks.

1 Answer 1

1

Not that I can see. Since it's a public-private key pair, the only thing that matters is that you hold the private key. Signing with Google vs. a trusted third party doesn't matter.

1
  • The answer is that id doesn't matter, thought I'd like to point out that I wasn't asking about a "Trusted Third Party" but signing it internally with a organization controlled, internal CA. Unless it fits with some process and the benefits can be clearly defined to follow this process, there does not appear to be any reason to do this, and in fact adds some additional complexity.
    – derekv
    Feb 2, 2012 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.