How to add an Alias to Android (Java) Keystore

Question

It is easy to create a new Java Keystore in Android-Studio. But I'd like to add a second Alias to this Keystore. For a second app for the same client. How do I do that? Or, if it is a not-so-good idea, what would be a better way?

edit: I do not intend to use different Keystores for same project. First project is done in Android Studio, second in Intel XDK. They will not share process or need accesses to data in the other.

Solution 1

You can also do that in Android Studio, just go to "Build > Generate Signed APK", skip to the next step, click the "3 dots gray button" at the right of the "Key alias" field, and then just type a new alias and password for your other app.

Solution 2

According to suggestion by google, it says

Signing Considarations:

You should sign all of your APKs with the same certificate throughout the expected lifespan of your apps. There are several reasons why you should do so

App upgrade: When the system is installing an update to an app, it compares the certificate(s) in the new version with those in the existing version. The system allows the update if the certificates match. If you sign the new version with a different certificate, you must assign a different package name to the app—in this case, the user installs the new version as a completely new app.

App modularity: Android allows APKs signed by the same certificate to run in the same process, if the apps so request, so that the system treats them as a single app. In this way you can deploy your app in modules, and users can update each of the modules independently.

Code/data sharing through permissions: Android provides signature-based permissions enforcement, so that an app can expose functionality to another app that is signed with a specified certificate. By signing multiple APKs with the same certificate and using signature-based permissions checks, your apps can share code and data in a secure manner.

check https://developer.android.com/studio/publish/app-signing.html#strategies

read this answer to understant more on keystore, certificates and alias

Solution 3

Official Document says

In general, the recommended strategy for all developers is to sign all of your applications with the same certificate, throughout the expected lifespan of your applications. There are several reasons why you should do so ...

https://developer.android.com/studio/publish/app-signing.html#considerations

you can use same certificate. for all applications and also for make it simple you can use same Alias for all your apps

Comments

[Jon Tinsman]

Although they say you should sign all your apps with the same certificate, it put some constraints through the reasons. Like having your apps communicate with each other or sharing data between your applications. For instance if you have a suite of applications like (Docs, Sheets, etc) then they should have shared data and be signed with the same certificate. Down side is if you make a viral app and want to sell it, you need to provide the certificate as well. This means that the buyer will have the certificate for other apps if you shared. I personally sign unrelated apps separately.

[Tom]

There are valid reasons for adding a new key, eg. migrating to use .AAB's with Google Play and wanting to generate an upload key.