diff --git a/src/com/android/settings/wifi/WifiConfigController.java b/src/com/android/settings/wifi/WifiConfigController.java
index d7b42996308..4bdc0a478b3 100644
--- a/src/com/android/settings/wifi/WifiConfigController.java
+++ b/src/com/android/settings/wifi/WifiConfigController.java
@@ -1216,6 +1216,11 @@ public class WifiConfigController implements TextWatcher,
         }
     }
 
+    @VisibleForTesting
+    KeyStore getKeyStore() {
+        return KeyStore.getInstance();
+    }
+
     private void loadCertificates(
             Spinner spinner,
             String prefix,
@@ -1232,8 +1237,12 @@ public class WifiConfigController implements TextWatcher,
         if (showUsePreinstalledCertOption) {
             certs.add(mUseSystemCertsString);
         }
-        certs.addAll(
-                Arrays.asList(KeyStore.getInstance().list(prefix, android.os.Process.WIFI_UID)));
+        try {
+            certs.addAll(
+                Arrays.asList(getKeyStore().list(prefix, android.os.Process.WIFI_UID)));
+        } catch (Exception e) {
+            Log.e(TAG, "can't get the certificate list from KeyStore");
+        }
         certs.add(noCertificateString);
 
         final ArrayAdapter<String> adapter = new ArrayAdapter<String>(
diff --git a/tests/robotests/src/com/android/settings/wifi/WifiConfigControllerTest.java b/tests/robotests/src/com/android/settings/wifi/WifiConfigControllerTest.java
index bbe104c1641..1654d6d8a20 100644
--- a/tests/robotests/src/com/android/settings/wifi/WifiConfigControllerTest.java
+++ b/tests/robotests/src/com/android/settings/wifi/WifiConfigControllerTest.java
@@ -20,11 +20,14 @@ import static com.google.common.truth.Truth.assertThat;
 import static org.mockito.Mockito.any;
 import static org.mockito.Mockito.anyBoolean;
 import static org.mockito.Mockito.anyInt;
+import static org.mockito.Mockito.anyString;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import android.content.Context;
+import android.os.ServiceSpecificException;
+import android.security.KeyStore;
 import android.view.LayoutInflater;
 import android.view.View;
 import android.view.ViewGroup;
@@ -56,6 +59,8 @@ public class WifiConfigControllerTest {
     private View mView;
     @Mock
     private AccessPoint mAccessPoint;
+    @Mock
+    private KeyStore mKeyStore;
 
     public WifiConfigController mController;
     private static final String HEX_PSK = "01234567012345670123456701234567012345670123456701234567"
@@ -210,6 +215,21 @@ public class WifiConfigControllerTest {
         assertThat(mView.findViewById(R.id.eap).getVisibility()).isEqualTo(View.GONE);
     }
 
+    @Test
+    public void loadCertificates_keyStoreListFail_shouldNotCrash() {
+        // Set up
+        when(mAccessPoint.getSecurity()).thenReturn(AccessPoint.SECURITY_EAP);
+        when(mKeyStore.list(anyString()))
+            .thenThrow(new ServiceSpecificException(-1, "permission error"));
+
+        mController = new TestWifiConfigController(mConfigUiBase, mView, mAccessPoint,
+              WifiConfigUiBase.MODE_CONNECT);
+
+        // Verify that the EAP method menu is visible.
+        assertThat(mView.findViewById(R.id.eap).getVisibility()).isEqualTo(View.VISIBLE);
+        // No Crash
+    }
+
     public class TestWifiConfigController extends WifiConfigController {
 
         private TestWifiConfigController(
@@ -221,5 +241,8 @@ public class WifiConfigControllerTest {
         boolean isSplitSystemUser() {
             return false;
         }
+
+        @Override
+        KeyStore getKeyStore() { return mKeyStore; }
     }
 }