I also found the same error message within the google play console, when first uploading a new app signed with an existing keystore
key.
To try and understand why my key was insecue I found the requirements from google for a signing key. Key requirements
Google ask that the key:
- Must be an RSA key that's 2048 bits or more.
- DSA, EC and RSA keys that are less than 2048 bits aren’t supported.
It is possible to check this using the program keytool
. Using keytool
keytool -list -alias <your-key-name> -keystore <path-to-production-keystore>
After I did this, I got an error to say my jkskey was considered a security risk and I could see that the certificate was only 1024-bit.
The certificate uses the SHA1withRSA signature algorithm which is considered a security risk. This algorithm will be disabled in a future update.
The certificate uses a 1024-bit RSA key which is considered a security risk. This key size will be disabled in a future update.
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore x.keystore -destkeystore x.keystore -deststoretype pkcs12".
I then did two things:
- Updated the keystore using the recommendated function in the warning message.
- Added a new alias within android studio.
Note: If you perform the jks update and keep the src and dest the same, it will backup the old key as well.
Migrated "x.keystore" to PKCS12. The JKS keystore is backed up as "x.keystore.old".