jarsigner: the signer's certificate is self signed warning

I was publishing an app to the Aptoide app store. They gave me a blank apk to sign it with the same Keystore used in my main app. I signed the app using command and jarsigner.

The app signing is successful but it shows a warning:

the signer's certificate is self-signed

I searched about it but most of the solutions available are for SSL certificate, not apk signing.

tldr; It has no implication for Android apps.

First, you should sign your APK with apksigner instead of jarsigner: apksigner has been created specifically for Android to sign APKs and is far more efficient, while jarsigner was designed to sign any JAR so some of the messages you see don't make much sense in Android world.

To explain this particular message, you have to understand that when creating a certificate (in a keystore), the certificate is cryptographically signed as well. If signed by a "trusted entity", people who see this certificate can verify that the certificate was effectively created by you. However, Android does not verify the signature of certificates (note: it does verify however the signature of the APK), so this signature is useless. Because the certificate needs to be signed, the easiest is to sign it with the private key the certificate was issued from: this is why it's called self-signing.