On Mon, Apr 11, 2011 at 10:44 PM, Bob Kerns <[email protected]> wrote: > When a trusted CA signs a cert, they have done some leg work to verify that > you are indeed who you say you are. Other than that, they're not adding > value -- though I'd argue that's an important defense against malicious > apps! >
This is an interesting take on CAs: https://docs.google.com/present/view?id=df9sn445_206ff3kn9gs&pli=1 > I don't know that there's any reason the cert you use has to be > self-signed. If you have a code signing cert from one of the trusted CAs, it > *should* work just fine. I've been curious about that.... > Generally CAs only sign certs that are valid for a year or so, since that model relies on continued verification. Android is the opposite -- we want you to have a self-signed cert that lasts a long time, since it is your real identity. You definitely do not want to use a cert that expires soon, because there is currently no way to migrate to a new cert. (We'll have a solution at some point, there is plenty of time.) But I don't know exactly how the Android team use the certs -- or perhaps > they ignore them altogether and simply use the public key itself. > The Android platform treats the public cert as a binary blob. If that binary data is the same, then the cert is the same. Otherwise it is not. -- Dianne Hackborn Android framework engineer [email protected] Note: please don't send private questions to me, as I don't have time to provide private support, and so won't reply to such e-mails. All such questions should be posted on public forums, where I and others can see and answer them. -- You received this message because you are subscribed to the Google Groups "Android Developers" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/android-developers?hl=en
