• installCertificateToKeystore(String, byte[], String, String, int)
• getCertificatesFromKeystore(int)
• deleteCertificateFromKeystore(CertificateInfo, int)
• getCredentialStorageStatus()

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

 try {
     // In order to validate the application's signature, fill this variable with the desired
     // signature.
     String signature = null;
 
     // List of packages that shall be able to use certificate management APIs
     List<AppIdentity> packageList = new ArrayList<AppIdentity>();
     packageList.add(new AppIdentity("com.trusted.app", signature));
 
     boolean result = certProvisioning.addPackagesToCertificateWhiteList(packageList);
     if (result == true) {
         // List of packages successfully added to certificate management whitelist
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

 try {
     // In order to validate the application's signature, fill this variable with the desired
     // signature.
     String signature = null;
 
     // List of packages that shall be able to use certificate management APIs
     List<AppIdentity> packageList = new ArrayList<AppIdentity>();
     packageList.add(new AppIdentity("com.trusted.app", signature));
 
     boolean result = certProvisioning.addPackagesToCertificateWhiteList(packageList);
     if(result == true) {
         // List of packages successfully added to certificate management whitelist
     }
 } catch(SecurityException e) {
     Log.w(TAG, "SecurityException: "+ e);
 }
 

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  String filePath = "/sdcard/class2.crt";
  byte[] certData = getByteArray(filePath); //internal function to retrieve
                                            //byte array from file.

  try {
      boolean result1, result2;
      CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
      X509Certificate cert = (X509Certificate) certFactory
              .generateCertificate(new ByteArrayInputStream(certData));

      CertificateInfo certInfo = new CertificateInfo(cert);

      // uninstalling certificate from Android Default keystore
      // if certInfo is a system certificate, then it will only be disabled in system.
      result1 = certProvisioning.deleteCertificateFromKeystore(certInfo,
               CertificateProvisioning.KEYSTORE_DEFAULT);

      if(CertificateProvisioning.ERROR_KEYSTORE_NONE ==
           certProvisioning.getCredentialStorageStatus()) {
           // uninstalling certificate from Wifi and VPN and Apps keystores (it will only work for owner space)
           result2 = certProvisioning.deleteCertificateFromKeystore(certInfo,
              CertificateProvisioning.KEYSTORE_FOR_WIFI | CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);
      }

      if(result1 == true) {
          // certificate successfully removed/disabled from Android Default keystore
      }

      if(result2 == true) {
          // certificate successfully removed from WiFi and VPN and Apps keystores
      }
  } catch(SecurityException e) {
      Log.w(TAG, "SecurityException: "+ e);
  } catch (CertificateException e) {
      Log.w(TAG, "CertificateException: " + e);
  }
 

  // When you create container successfully, containerID will be returned via intent.
  // Use this containerID in below API.
  EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
  KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
  CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

  String filePath = "/sdcard/class2.crt";
  byte[] certData = getByteArray(filePath); //internal function to retrieve
                                            //byte array from file.

  try {
      boolean result = false;
      CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
      X509Certificate cert = (X509Certificate) certFactory
              .generateCertificate(new ByteArrayInputStream(certData));

      CertificateInfo certInfo = new CertificateInfo(cert);

      // uninstalling certificate from VPN and applications keystore
      result = certProvisioning.deleteCertificateFromKeystore(certInfo,
              CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);

      if(result == true) {
          // certificate successfully removed from VPN and Apps keystore of container
      }
  } catch(SecurityException e) {
      Log.w(TAG, "SecurityException: "+ e);
  } catch (CertificateException e) {
      Log.w(TAG, "CertificateException: " + e);
  }
 

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  try {

     //retrieving certificates from all keystores (this call will work only on owner space):
     List<CertificateInfo> list = certProvisioning.getCertificatesFromKeystore
             (CertificateProvisioning.KEYSTORE_DEFAULT |
             CertificateProvisioning.KEYSTORE_FOR_WIFI |
             CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);

     if (list != null && !list.isEmpty()) {
         X509Certificate cert;

         for(CertificateInfo certInfo : list) {
             Log.d(TAG, "Preloaded : " + certInfo.getSystemPreloaded()
                     + ". Enabled : " + certInfo.getEnabled());

             cert = (X509Certificate)certInfo.getCertificate();
             Log.d(TAG, "Version :" + cert.getVersion()
                     + ". Serial no.: " + cert.getSerialNumber().toString());
         }
     }
  } catch(SecurityException e) {
     Log.w(TAG,"SecurityException: "+e);
  }
 

  // When you create container successfully, containerID will be returned via intent.
  // Use this containerID in below API.
  EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
  KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
  CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

  try {

     // retrieving certificates from VPN and Apps keystore
     List<CertificateInfo> list = certProvisioning.getCertificatesFromKeystore
             (CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);

     if (list != null && !list.isEmpty()) {
         X509Certificate cert;

         for(CertificateInfo certInfo : list) {
             cert = (X509Certificate)certInfo.getCertificate();
             Log.d(TAG, "Version :" + cert.getVersion()
                     + ". Serial no.: " + cert.getSerialNumber().toString());
         }
     }
  } catch(SecurityException e) {
     Log.w(TAG,"SecurityException: "+e);
  }
 

 EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();
 
 try {
     // Retrieving all whitelisted trusted applications that are able to call
     // MDM APIs to manage certificates
     List<AppIdentity> packageList = certProvisioning.getPackagesFromCertificateWhiteList();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
  

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

 try {
     // Retrieving all trusted applications that are able to call
     // MDM APIs to manage certificates
     List<AppIdentity> packageList = certProvisioning.getPackagesFromCertificateWhiteList();
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  try {
      List<CertificateInfo> list = certProvisioning.getSystemCertificates();
      if (!list.isEmpty()) {
         X509Certificate cert;

         for(CertificateInfo certInfo : list) {
             Log.d(TAG, "Enabled : " + certInfo.getEnabled());

             cert = (X509Certificate)certInfo.getCertificate();
             Log.d(TAG, "Version :" + cert.getVersion()
                     + ". Serial no." + cert.getSerialNumber().toString())
         }
      }
  } catch(SecurityException e) {
     Log.w(TAG,"SecurityException: "+e);
  }
 

       // When you create container successfully, containerID will be returned via intent.
       // Use this containerID in below API.
       EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
       KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
       CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();
       try {
           List<CertificateInfo> list = certProvisioning.getSystemCertificates();
           if (!list.isEmpty()) {
               X509Certificate cert;

               for(CertificateInfo certInfo : list) {
                   Log.d(TAG, "Enabled : " + certInfo.getEnabled());

                   cert = (X509Certificate)certInfo.getCertificate();
                   Log.d(TAG, "Version :" + cert.getVersion()
                         + ". Serial no." + cert.getSerialNumber().toString())
               }
           }
       } catch(SecurityException e) {
           Log.w(TAG,"SecurityException: "+e);
       }
       

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  String filePath = "/sdcard/class3.crt";
  byte[] certData = getByteArray(filePath); //internal function to retrieve
                                            //byte array from file.
  try {
      boolean result1, result2;

      //installing into Wifi keystore (it will only work for owner space):
      result1 = certProvisioning.installCertificateToKeystore
              (CertificateProvisioning.TYPE_CERTIFICATE, certData, "mycert", "123456",
              CertificateProvisioning.KEYSTORE_FOR_WIFI);

      //installing into Wifi and VPN and Apps keystores (it will only work for owner space):
      if(CertificateProvisioning.ERROR_KEYSTORE_NONE ==
           certProvisioning.getCredentialStorageStatus()) {
           result2 = certProvisioning.installCertificateToKeystore
               (CertificateProvisioning.TYPE_CERTIFICATE, certData, "mycert", "123456",
               CertificateProvisioning.KEYSTORE_FOR_WIFI | CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);
      }

      if(true == result1) {
          //certificate installed to Wifi keystore successfully
      }

      if(true == result2) {
          //certificate installed to Wifi and VPN and Apps keystores successfully
      }
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }
  

  // When you create container successfully, containerID will be returned via intent.
  // Use this containerID in below API.
  EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
  KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
  CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();
  String filePath = "/sdcard/class3.crt";
  byte[] certData = getByteArray(filePath); //internal function to retrieve
                                            //byte array from file.
  try {
      boolean result = false;

      //installing into VPN and Applications Keystore:
      result = certProvisioning.installCertificateToKeystore
              (CertificateProvisioning.TYPE_CERTIFICATE, certData, "mycert", "123456",
              CertificateProvisioning.KEYSTORE_FOR_VPN_AND_APPS);
      }

      if(result == true) {
          //certificate successfully installed to VPN and Apps keystore of container
      }
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }
 

An administrator can use this API to install certificates of the type TYPE_CERTIFICATE or TYPE_PKCS12 along with data in form of byte[].

If the certificate is being installed for the first time or the credentials storage is locked, the user is asked to set a new password and certificate name. If keystore is unlocked, the user is asked to enter the certificate name and the destiny keystore (Wifi keystore or VPN and applications keystore). If the certificate is a CA, it will be duplicated to Android Default keystore.

If the administrator does not want user interaction, the recommendation is to use installCertificateToKeystore(String, byte[], String, String, int).

NOTE(No longer applicable since Knox API level 30):

The credential storage must be in ERROR_KEYSTORE_NONE state, otherwise the user will be prompted to set a lock screen password. In order to get the credential storage state, please consider using getCredentialStorageStatus() API.

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();
  String filePath = "/data/system/class3.crt";
  byte[] bytes = getByteArray(filePath);//internal function to retrieve
                                         //byte array from file.
  try {
      certProvisioning.installCertificateWithType(CertificateProvisioning.TYPE_CERTIFICATE, bytes);
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }

If the certificate is being installed for first time or the credentials storage is locked, the user is asked to set a new password and certificate name for each certificate. If keystore is unlocked, the user is asked to enter a certificate name and the destiny keystore (Wifi keystore or VPN and applications keystore) for each certificate.

If the administrator does not want user interaction, the recommendation is to use installCertificateToKeystore(String, byte[], String, String, int)

NOTE(No longer applicable since Knox API level 30):

The credential storage must be in ERROR_KEYSTORE_NONE state, otherwise the user will be prompted to set a lock screen password. In order to get the credential storage state, please consider using getCredentialStorageStatus() API.

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  try {
      certProvisioning.installCertificatesFromSdCard();
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }

 EEnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
 CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();
 
 try {
     // In order to validate the application's signature, fill this variable with the desired
     // signature.
     String signature = null;
 
     // List of packages to be removed from certificate whitelist
     List<AppIdentity> packageList = new ArrayList<AppIdentity>();
     packageList.add(new AppIdentity("com.trusted.app", signature));
 
     boolean result = certProvisioning.removePackagesFromCertificateWhiteList(packageList);
     if(result == true) {
         // List of packages successfully removed from certificate management white list
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

 // When you create container successfully, containerID will be returned via intent.
 // Use this containerID in below API.
 EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
 KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
 CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

 try {
     // In order to validate the application's signature, fill this variable with the desired
     // signature.
     String signature = null;
 
     // List of packages to be removed from certificate white list
     List<AppIdentity> packageList = new ArrayList<AppIdentity>();
     packageList.add(new AppIdentity("com.trusted.app", signature));
 
     boolean result = certProvisioning.removePackagesFromCertificateWhiteList(packageList);
     if(result == true) {
         // List of packages successfully removed from certificate management whitelist
     }
 } catch (SecurityException e) {
     Log.w(TAG, "SecurityException: " + e);
 }
 

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  try {
      boolean result = certProvisioning.resetCredentialStorage();
      if(true == result) {
          //credential storage is cleared
      }
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }
  

  // When you create container successfully, containerID will be returned via intent.
  // Use this containerID in below API.
  EnterpriseKnoxManager ekm = EnterpriseKnoxManager.getInstance(context);
  KnoxContainerManager kcm = ekm.getKnoxContainerManager(containerID);
  CertificateProvisioning certProvisioning = kcm.getCertificateProvisioning();

  try {
      boolean result = certProvisioning.resetCredentialStorage();
      if(true == result) {
          //credential storage is cleared
      }
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }
  

1. Installing or removing certificates.
2. Retrieving information about installed certificates.

NOTE:

After the device boots up and the user unlocks the device for the first time, credential storage remains unlocked until the next reboot.

  EnterpriseDeviceManager edm = EnterpriseDeviceManager.getInstance(context);
  CertificateProvisioning certProvisioning = edm.getCertificateProvisioning();

  try {
      boolean result = certProvisioning.unlockCredentialStorage("abc34567");
      if(true == result) {
          // dialog to set a screen lock was prompted correctly.
      }
  } catch(SecurityException e) {
      Log.w(TAG,"SecurityException: "+e);
  }