title: Use provided upload_cert.der to sign a release Android APK file
body: <p>I've just enrolled in the Google Play App Signing program, which required uploading an encrypted version of the release keystore and had an "optional" step for creating an upload keystore - optional is in quotes, because I think it should be a required step, but anyway, after a successful enrollment, I'm now left with an <strong>Upload certificate</strong>, which I should somehow use to sign my future app releases.</p>
  
  <p>What I've done so far: I created a new keystore from Android Studio, set the store and alias passwords and tried to import the <strong>upload_cert.der</strong> to the existing alias - failed:</p>
  
  <pre><code>keytool -importcert -file upload_cert.der -alias upload -keystore upload-keystore.jks
  </code></pre>
  
  <blockquote>
    <p>keytool error: java.lang.Exception: Public keys in reply and keystore
    don't match</p>
  </blockquote>
  
  <p>I've also tried to import the upload certificate without specifying an alias (or removing the existing alias and creating a new one), or with a different alias:</p>
  
  <pre><code>keytool -importcert -file upload_cert.der -keystore upload-keystore.jks
  </code></pre>
  
  <p>...failed as well: ended up creating a new alias called <em>mykey</em>, which wasn't password protected and failed with the message: </p>
  
  <blockquote>
    <p>Caused by: java.lang.RuntimeException: com.android.ide.common.signing.KeytoolException: Failed to read key upload from store "/path/to/upload-keystore.jks": trusted certificate entries are not password-protected</p>
  </blockquote>
  
  <p>...so naturally, I tried to set a password for the alias:</p>
  
  <pre><code>keytool -keypasswd -alias upload -keystore upload-keystore.jks
  </code></pre>
  
  <p>which failed as well with the message:</p>
  
  <blockquote>
    <p>keytool error: java.lang.Exception: Alias  has no key</p>
  </blockquote>
  
  <p>...and now I've run out of ideas.</p>
  
  <p>In the meantime, I've sent a question/request to Google Play Support to renew my upload key, but, I'm hoping there is a solution to this situation (the support is kinda slow to reply), since the documentation doesn't imply in any way that generating an upload keystore and uploading the encrypted private key of that key store is a requirement. So, either the documentation is vague/unclear/wrong, or there is a way to use the generated upload_cert.der. Any thoughts?</p>
  
  <p><strong>Edit:</strong> </p>
  
  <p>Thanks to the answer and comment provided by <a href="https://stackoverflow.com/users/4265103/pierre">Pierre</a>, I realized that if you do not create/provide an upload key, your existing original signing key should be used, with the <strong>upload_cert.der</strong>. So, the only requirement would be to insert the upload certificate by running: </p>
  
  <pre><code>keytool -importcert -file upload_cert.der -keystore original-signing-keystore.jks
  </code></pre>
  
  <p>...and you should be able to continue publishing your applications to the Play Store.</p>