Generate Keystore Script

README.md

Android App Signing Keystore Generator

A robust, production-ready Bash script to automate the secure generation of Android App Signing Keystores using Java's keytool utility. This script complies with modern Android security standards, including the PKCS12 keystore format, matching store/key passwords, and Google Play's 25+ year validity recommendation.

Key Features

• Modern Standards: Generates standard standard-compliant PKCS12 format keystores.
• Identical Passwords: Uses a single password for both the store and the key to prevent PKCS12 keytool issues.
• Extended Validity: Sets key validity to 20,000 days (approximately 54 years), meeting and exceeding Google Play's minimum 25-year mandate.
• Descriptive CLI Flags: Uses expressive, self-documenting command-line arguments instead of cryptic single-letter options.

---

Installation & Setup

1. Save the generator script to your local system as generate_keystore.sh.
2. Give the file executable permissions in your terminal:

   chmod +x generate_keystore.sh

---

Usage

You must provide a password using the --password flag. All other fields have sensible default values but should be configured for production releases.

Standard Command

./generate_keystore.sh \
  --keystore-name "production-app.keystore" \
  --key-alias "production-alias" \
  --password "YourSecurePassword123" \
  --common-name "Sarah Dev" \
  --org-unit "Mobile Department" \
  --organization "My Tech Company" \
  --locality "Kampala" \
  --state "Central" \
  --country "UG"

Script Help Options

To see all available CLI options and default values:

./generate_keystore.sh --help

---

Available Options

Option	Description	Default Value	Required
--password <value>	Secure password used for both keystore and key integrity	None	Yes
--keystore-name <value>	Destination file path for the generated keystore	my-release-key.keystore	No
--key-alias <value>	Internal alias name for the private key	my-key-alias	No
--common-name <value>	Developer or Organization representative name	Unknown	No
--org-unit <value>	Business unit, department, or team designation	Dev	No
--organization <value>	Company name	Company	No
--locality <value>	City or municipality	City	No
--state <value>	State, province, or region	State	No
--country <value>	Two-letter ISO country code	US	No

---

Google Play App Signing Guidelines

Modern Android development workflows utilize the generated keystore file as an Upload Key.

1. Google Play Console Mandate: For new applications, Google Play manages your primary App Signing Key on secure Google infrastructure.
2. Your Responsibility: You will sign your local Android App Bundle (.aab) with the keystore generated by this script before uploading it to the Play Console.
3. Recovery: If you lose this upload key, you can reset it via the Play Console Developer support channel.

generate_keystore.sh

#!/bin/bash

# Default values
KEYSTORE_NAME="my-release-key.keystore"
KEY_ALIAS="my-key-alias"
PASSWORD=""
CN="Unknown"
OU="Dev"
O="Company"
L="City"
S="State"
C="US"

# Parse long options
while [[ $# -gt 0 ]]; do
  case "$1" in
    --keystore-name)
      KEYSTORE_NAME="$2"
      shift 2
      ;;
    --key-alias)
      KEY_ALIAS="$2"
      shift 2
      ;;
    --password)
      PASSWORD="$2"
      shift 2
      ;;
    --common-name)
      CN="$2"
      shift 2
      ;;
    --org-unit)
      OU="$2"
      shift 2
      ;;
    --organization)
      O="$2"
      shift 2
      ;;
    --locality)
      L="$2"
      shift 2
      ;;
    --state)
      S="$2"
      shift 2
      ;;
    --country)
      C="$2"
      shift 2
      ;;
    --help)
      echo "Usage: $0 [options]"
      echo "Options:"
      echo "  --keystore-name <value>  Filename of the keystore (Default: my-release-key.keystore)"
      echo "  --key-alias <value>      Alias for the key (Default: my-key-alias)"
      echo "  --password <value>       Password for both keystore and key (Required)"
      echo "  --common-name <value>    First and last name (Default: Unknown)"
      echo "  --org-unit <value>       Department or unit (Default: Dev)"
      echo "  --organization <value>   Company name (Default: Company)"
      echo "  --locality <value>       City (Default: City)"
      echo "  --state <value>          State or Province (Default: State)"
      echo "  --country <value>        Two-letter country code (Default: US)"
      exit 0
      ;;
    *)
      echo "Unknown option: $1"
      echo "Use --help to see available options."
      exit 1
      ;;
  esac
done

# Validate required password input
if [ -z "$PASSWORD" ]; then
  echo "Error: The --password option is required."
  exit 1
fi

# Build distinguished name string
DNAME="CN=$CN, OU=$OU, O=$O, L=$L, S=$S, C=$C"

# Execute keytool with 20000 days validity and matching passwords
keytool -genkeypair \
  -v \
  -storetype PKCS12 \
  -keystore "$KEYSTORE_NAME" \
  -alias "$KEY_ALIAS" \
  -keyalg RSA \
  -keysize 2048 \
  -validity 20000 \
  -storepass "$PASSWORD" \
  -keypass "$PASSWORD" \
  -dname "$DNAME"

echo "Keystore generation complete: $KEYSTORE_NAME"