diff --git a/android/config.go b/android/config.go
index bf8edcabf..56e952541 100644
--- a/android/config.go
+++ b/android/config.go
@@ -511,12 +511,13 @@ func (c *config) DefaultAppCertificateDir(ctx PathContext) SourcePath {
 	}
 }
 
-func (c *config) DefaultAppCertificate(ctx PathContext) SourcePath {
+func (c *config) DefaultAppCertificate(ctx PathContext) (pem, key SourcePath) {
 	defaultCert := String(c.ProductVariables.DefaultAppCertificate)
 	if defaultCert != "" {
-		return PathForSource(ctx, defaultCert)
+		return PathForSource(ctx, defaultCert+".x509.pem"), PathForSource(ctx, defaultCert+".pk8")
 	} else {
-		return c.DefaultAppCertificateDir(ctx).Join(ctx, "testkey")
+		defaultDir := c.DefaultAppCertificateDir(ctx)
+		return defaultDir.Join(ctx, "testkey.x509.pem"), defaultDir.Join(ctx, "testkey.pk8")
 	}
 }
 
diff --git a/java/androidmk.go b/java/androidmk.go
index 11151145a..40ebe5bc7 100644
--- a/java/androidmk.go
+++ b/java/androidmk.go
@@ -180,6 +180,8 @@ func (app *AndroidApp) AndroidMk() android.AndroidMkData {
 				if Bool(app.appProperties.Privileged) {
 					fmt.Fprintln(w, "LOCAL_PRIVILEGED_MODULE := true")
 				}
+
+				fmt.Fprintln(w, "LOCAL_CERTIFICATE :=", app.certificate.pem.String())
 			},
 		},
 	}
diff --git a/java/app.go b/java/app.go
index e8dc53539..df53375ae 100644
--- a/java/app.go
+++ b/java/app.go
@@ -77,6 +77,11 @@ type AndroidApp struct {
 	exportPackage android.Path
 	rroDirs       android.Paths
 	manifestPath  android.Path
+	certificate   certificate
+}
+
+type certificate struct {
+	pem, key android.Path
 }
 
 func (a *AndroidApp) DepsMutator(ctx android.BottomUpMutatorContext) {
@@ -132,18 +137,30 @@ func (a *AndroidApp) GenerateAndroidBuildActions(ctx android.ModuleContext) {
 		a.Module.compile(ctx, a.aaptSrcJar)
 	}
 
-	certificate := String(a.appProperties.Certificate)
-	if certificate == "" {
-		certificate = ctx.Config().DefaultAppCertificate(ctx).String()
-	} else if dir, _ := filepath.Split(certificate); dir == "" {
-		certificate = filepath.Join(ctx.Config().DefaultAppCertificateDir(ctx).String(), certificate)
-	} else {
-		certificate = filepath.Join(android.PathForSource(ctx).String(), certificate)
+	c := String(a.appProperties.Certificate)
+	switch {
+	case c == "":
+		pem, key := ctx.Config().DefaultAppCertificate(ctx)
+		a.certificate = certificate{pem, key}
+	case strings.ContainsRune(c, '/'):
+		a.certificate = certificate{
+			android.PathForSource(ctx, c+".x509.pem"),
+			android.PathForSource(ctx, c+".pk8"),
+		}
+	default:
+		defaultDir := ctx.Config().DefaultAppCertificateDir(ctx)
+		a.certificate = certificate{
+			defaultDir.Join(ctx, c+".x509.pem"),
+			defaultDir.Join(ctx, c+".pk8"),
+		}
 	}
 
-	certificates := []string{certificate}
+	certificates := []certificate{a.certificate}
 	for _, c := range a.appProperties.Additional_certificates {
-		certificates = append(certificates, filepath.Join(android.PathForSource(ctx).String(), c))
+		certificates = append(certificates, certificate{
+			android.PathForSource(ctx, c+".x509.pem"),
+			android.PathForSource(ctx, c+".pk8"),
+		})
 	}
 
 	packageFile := android.PathForModuleOut(ctx, "package.apk")
diff --git a/java/app_builder.go b/java/app_builder.go
index 676ed5853..945d7bdb3 100644
--- a/java/app_builder.go
+++ b/java/app_builder.go
@@ -61,7 +61,7 @@ var combineApk = pctx.AndroidStaticRule("combineApk",
 	})
 
 func CreateAppPackage(ctx android.ModuleContext, outputFile android.WritablePath,
-	resJarFile, dexJarFile android.Path, certificates []string) {
+	resJarFile, dexJarFile android.Path, certificates []certificate) {
 
 	// TODO(ccross): JNI libs
 
@@ -80,7 +80,7 @@ func CreateAppPackage(ctx android.ModuleContext, outputFile android.WritablePath
 
 	var certificateArgs []string
 	for _, c := range certificates {
-		certificateArgs = append(certificateArgs, c+".x509.pem", c+".pk8")
+		certificateArgs = append(certificateArgs, c.pem.String(), c.key.String())
 	}
 
 	// TODO(ccross): sometimes uncompress dex