Introduction to Certificates, Profiles, and App Signing

Read the original article：Introduction to Certificates, Profiles, and App Signing

Context

In the HarmonyOS ecosystem, security and identity verification are paramount. Before an application can be debugged on a physical device or released to the public, a trust relationship must be established between the local development environment (DevEco Studio) and the Huawei AppGallery Connect (AGC) platform.

This workflow applies to developers who need to register their HarmonyOS application, digitally sign it, and generate the necessary provisioning profiles to allow installation on Huawei devices.

Description

App signing in HarmonyOS involves three distinct but interconnected components managed through the Certificates, App IDs, and Profiles console:

1. App ID: The unique identifier for your application on the Huawei platform, linked to your specific Package Name.
2. Certificate: Verifies the digital identity of the developer. It requires uploading a Certificate Signing Request (CSR) generated from DevEco Studio.
3. Profile (Provisioning Profile): A file that binds the App ID, the Certificate, and the specific device permissions (Debug/Release) together.

This process ensures that the code has not been tampered with and originates from a verified developer.

Solution / Approach

Follow the steps below to successfully configure your application signature.

Phase 1: Registering the Application (App ID)

1. Log in to Console: Navigate to the Huawei AppGallery Connect portal and sign in.
2. Access Menu: From the dashboard, select Certificates, App IDs, and Profiles.
3. Create New App ID:
   • Select the App IDs tab.
   • Click the New button in the top right corner.
4. Configure App Details:
   • Platform: Select HarmonyOS.
   • Name: Enter your Application Name.
   • Package Name: Enter the exact Package Name (must match your local project configuration).
5. Project Association: Select the specific project this app belongs to from the dropdown menu.
6. Add Capabilities:
   • Navigate to the Capabilities tab/section.
   • Enable any specific features your app requires (e.g., Push Kits, Maps, etc.).
7. Verification: Once saved, confirm that your application appears in the App IDs list.

Phase 2: Adding the Certificate

Prerequisite: Ensure you have already generated a Certificate Signing Request (CSR) file within DevEco Studio on your local machine.

1. Navigate to Certificates: Switch to the Certificates tab within the same console.
   

2. Create Certificate: Click the New certificate button.

3. Upload CSR:

   • Select the certificate type (Development or Release).
   • Upload the .csr file generated from DevEco Studio.
   • Submit to generate the certificate.

4. Download: Once processed, the certificate is stored in AGC. (Note: You may need to download this .cer file to import it back into DevEco Studio later).

Phase 3: Generating the Profile

1. Navigate to Profiles: Switch to the Profiles tab.
2. Create Profile: Click the Add button.
3. Configuration:
   • Name: Give your profile a recognizable name.
   • Type: Select HarmonyOS.
   • App ID: Select the App ID created in Phase 1.
   • Certificate: Select the Certificate uploaded in Phase 2.
   • Devices (Debug only): If creating a debug profile, select the registered test devices.
4. Finalize: Click Submit. Your .p7b profile file is now ready for download.

Key Takeaways

• Order Matters: You cannot create a Profile without first creating an App ID and a Certificate.
• Package Name Consistency: The package name entered in the App ID section must match the bundleName in your DevEco Studio project's app.json5 file exactly.
• One-to-One Binding: A Provisioning Profile effectively ties a specific App ID to a specific Certificate. If you change your certificate, you must regenerate the profile.
• Capabilities: If you add new capabilities (permissions) to your App ID later, you must regenerate and download the Profile again for those changes to take effect.

Written by Baris Tuzemen