Issue with exporting to Google Play Console

Dear Construct3 forum,

I need some help on exporting signed android bundle.

I followed the steps created keystore.jks and copied SHA-1 signature, in Play Console I tried both "Export and upload a key from Java keystore" or "Export and upload a key (not using Java Keystore)" the system said is "Zip file contains no encrypted private key".

I checked their instructions, it seems I'm missing something like PEM file. I don't think I missed download PEM file while using C3 generate the keystore.jks, nor the BUILDING A SIGNED APK FOR ANDROID IN CONSTRUCT 3 mentioned anything about PEM.

I tried "Let Google manage and protect your app signing key" option since this is what Google recommend, but I'm totally clueless about this one, they let me download "deployment_cert.der" which seems totally useless with C3.

There are many ways to sign a package.

When I build a package "aab" for publishing via construct3 I sign it with my key (as on the screenshot).

It can be uploaded to google store right away.

Hi igortyhon,

I have already done what you said, have a keystore.jks, alias, password etc, I have my signed-bundle.aab ready, but the issue I have is uploading the keystore.jks to google.

no matter I zip the keystore.jks alone or zip with the encryption_public_key.pem that download from google on step1, it always fail.

Updated: I tried using the PEPK.jar from Google, must download latest OpenJDK (https://jdk.java.net/) to run:

java -jar pepk.jar --keystore=keystore.jks --alias=myalias --output=output.zip --include-cert --rsa-aes-encryption --encryption-key-path=encryption_public_key.pem

It generate the zip file Google wants.

The JDK part is a pain in the a$$, and I wish this part of using JDK export and upload keystore was in the BUILDING A SIGNED APK FOR ANDROID IN CONSTRUCT 3, it will save me soooooooo much time.

Thanks for igortyhon your reply again.

I don't upload any keys to google store now, I consider it archaic and an old method.

When I release a new application, I build a signed "aab" in C3 as I wrote in the screenshot above and upload it to google store.

I trust google to sign distributed packages.

Hi igortyhon,

Do you mean "Let Google manage and protect your app signing key" option? If yes, I dont understand about this option. The keystore is on my end not on Google, how do Google know my .aab is signed correctly?

It's simple. When you download a signed "aab" Google sees what key it is signed with and stores its fingerprint (SHA-256) and when you distribute the "apk" it signs it with its own key for distribution. In the console you can see these two keys.

Don't worry, once you upload your signed "aab" to the store, it won't let you download packages signed with other keys.

Hi igortyhon,

Does that means I should just use "Let Google manage and protect your app signing key" option, and upload the signed .aab from C3, then everythings good? Dxmn!

That's what I'm doing.

Believe me, protection is not what a developer should focus on, the main thing is not to violate the rules of the store, if Google bans you for violating the rules, it's forever.

Thanks for the advice igortyhon

Its my very first time to deploy an app on Google, was over-thinking everything maybe because of all the stuff in Play Console overwhelming my head.

igortyhon - thanks for all this info. I had similar questions myself.