diff --git a/wifi/java/android/net/wifi/WifiEnterpriseConfig.java b/wifi/java/android/net/wifi/WifiEnterpriseConfig.java
index abd573f4bea98..d35ce3c7a42c2 100644
--- a/wifi/java/android/net/wifi/WifiEnterpriseConfig.java
+++ b/wifi/java/android/net/wifi/WifiEnterpriseConfig.java
@@ -1425,10 +1425,19 @@ public class WifiEnterpriseConfig implements Parcelable {
         if (mEapMethod != Eap.PEAP && mEapMethod != Eap.TLS && mEapMethod != Eap.TTLS) {
             return false;
         }
-        if (!mIsAppInstalledCaCert && TextUtils.isEmpty(getCaPath())) {
+        if (TextUtils.isEmpty(getAltSubjectMatch())
+                && TextUtils.isEmpty(getDomainSuffixMatch())) {
+            // Both subject and domain match are not set, it's insecure.
             return true;
         }
-        return TextUtils.isEmpty(getAltSubjectMatch()) && TextUtils.isEmpty(
-                getDomainSuffixMatch());
+        if (mIsAppInstalledCaCert) {
+            // CA certificate is installed by App, it's secure.
+            return false;
+        }
+        if (getCaCertificateAliases() != null) {
+            // CA certificate alias from keyStore is set, it's secure.
+            return false;
+        }
+        return TextUtils.isEmpty(getCaPath());
     }
 }
diff --git a/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java b/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java
index 268645c85cae7..62485ecb6f7b7 100644
--- a/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java
+++ b/wifi/tests/src/android/net/wifi/WifiEnterpriseConfigTest.java
@@ -565,6 +565,13 @@ public class WifiEnterpriseConfigTest {
         secureConfig.setCaCertificate(FakeKeys.CA_CERT0);
         secureConfig.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH);
         assertFalse(secureConfig.isInsecure());
+
+        WifiEnterpriseConfig secureConfigWithCaAlias = new WifiEnterpriseConfig();
+        secureConfigWithCaAlias.setEapMethod(Eap.PEAP);
+        secureConfigWithCaAlias.setPhase2Method(Phase2.MSCHAPV2);
+        secureConfigWithCaAlias.setCaCertificateAliases(new String[]{"alias1", "alisa2"});
+        secureConfigWithCaAlias.setDomainSuffixMatch(TEST_DOMAIN_SUFFIX_MATCH);
+        assertFalse(secureConfigWithCaAlias.isInsecure());
     }
 
 }