从私钥和证书重新创建密钥库文件

Question

I am trying to sign an Android app but apparently the original keystore file is not available. All I have been given is the following:

1. Private key md5 0123456789abcdef0123456789abcdef <-- fictitious values but the
2. Certificate md5 fedcba9876543210fedcba9876543210 <-- original are 32 hex digits
3. The signed production Android app

Is there any way to recreate a keystore file from these assets so that I can use the usual Android build process, (eg jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore my-release-key.keystore my_application.apk alias_name) to sign updated builds of the Android app in the same way as the original app?

Alternatively can I sign the app in a different way using these values whilst maintaining consistency with the original app?

Answer 1

No, you cannot. Once the private key is lost there is no way to recreate it. If that would be possible the private key would not have much value. MD5 is a one way function, it cannot be reverted and - if the input is large enough, such as a private key - it cannot be brute forced either. The MD5 values over the key and certificate are only used to identify the key and certificate (called fingerprinting as the values are tied to the value of key and certificate).

All you can do is to create a new key pair + certificate (signed by the same CA certificate) and use that to sign the app.