shwenzhang/AndResGuard · error · ParameterException

--ks and --cert may not be specified at the same time

Error message

--ks and --cert may not be specified at the same time

What it means

loadPrivateKeyAndCerts throws this when both keystoreFile (--ks) and certFile (--cert) are set. A KeyStore already contains the certificate chain, so supplying a separate cert file alongside it is contradictory and the tool refuses the invocation.

Solutions

  1. Remove --cert (and --key) and rely on the KeyStore to provide the certificate chain.
  2. Remove --ks to use file-based signing with both --key and --cert.
  3. Audit the build script so only one credential mode is ever assembled.

Example fix

// before
apksigner sign --ks release.jks --cert release.x509.pem app.apk
// after
apksigner sign --ks release.jks --ks-key-alias mykey app.apk
Defensive patterns

Strategy: validation

Validate before calling

// shell pre-check
if [ -n "$KS_ARG" ] && [ -n "$CERT_ARG" ]; then
  echo "ERROR: --cert conflicts with --ks; the KeyStore already holds the cert chain" >&2; exit 1
fi

Prevention

When it happens

Trigger: Running apksigner sign with both --ks <keystore> and --cert <x509 pem file> specified.

Common situations: Converting a signing invocation from file-based (--key/--cert) to keystore-based and deleting only the --key flag; scripted builds that conditionally append --cert while --ks remains.

Understand the failure class

Background: "mutually exclusive" flag errors: what "can't supply both nx and xx", "--raw is not compatible with -i" and "cannot be used with" mean, and how to fix them — this error's family across 29 libraries.

Related errors

AI-assisted analysis of shwenzhang/AndResGuard@e4df245d82 (2026-09-12). Data as JSON: /api/errors/755c54a94b008e38. Report an issue: GitHub.

Appendix: source

Thrown at AndResGuard-core/src/main/java/apksigner/ApkSignerTool.java:636

             && (keystorePasswordSpec == null)
             && (keyPasswordSpec == null)
             && (keystoreType == null)
             && (keystoreProviderName == null)
             && (keystoreProviderClass == null)
             && (keystoreProviderArg == null)
             && (keyFile == null)
             && (certFile == null)
             && (v1SigFileBasename == null)
             && (privateKey == null)
             && (certs == null);
    }

    private void loadPrivateKeyAndCerts(PasswordRetriever passwordRetriever) throws Exception {
      if (keystoreFile != null) {
        if (keyFile != null) {
          throw new ParameterException("--ks and --key may not be specified at the same time");
        } else if (certFile != null) {
          throw new ParameterException("--ks and --cert may not be specified at the same time");
        }
        loadPrivateKeyAndCertsFromKeyStore(passwordRetriever);
      } else if (keyFile != null) {
        loadPrivateKeyAndCertsFromFiles(passwordRetriever);
      } else {
        throw new ParameterException("KeyStore (--ks) or private key file (--key) must be specified");
      }
    }

    private void loadPrivateKeyAndCertsFromKeyStore(PasswordRetriever passwordRetriever) throws Exception {
      if (keystoreFile == null) {
        throw new ParameterException("KeyStore (--ks) must be specified");
      }

      // 1. Obtain a KeyStore implementation
      String ksType = (keystoreType != null) ? keystoreType : KeyStore.getDefaultType();
      KeyStore ks;
      if (keystoreProviderName != null) {

View on GitHub (pinned to e4df245d82)