diff --git a/main/src/main/java/de/blinkt/openvpn/LaunchVPN.java b/main/src/main/java/de/blinkt/openvpn/LaunchVPN.java
index 90ea053a..1b58f2bb 100644
--- a/main/src/main/java/de/blinkt/openvpn/LaunchVPN.java
+++ b/main/src/main/java/de/blinkt/openvpn/LaunchVPN.java
@@ -23,6 +23,8 @@ import android.os.Bundle;
 import android.os.IBinder;
 import android.os.RemoteException;
 import android.preference.PreferenceManager;
+import android.security.KeyChain;
+import android.security.KeyChainAliasCallback;
 import android.text.InputType;
 import android.text.TextUtils;
 import android.text.method.PasswordTransformationMethod;
@@ -31,6 +33,8 @@ import android.widget.CheckBox;
 import android.widget.CompoundButton;
 import android.widget.EditText;
 
+import androidx.annotation.Nullable;
+
 import java.io.IOException;
 
 import de.blinkt.openvpn.api.ExternalAppDatabase;
@@ -159,7 +163,20 @@ public class LaunchVPN extends Activity {
         } else {
             mSelectedProfile = profileToConnect;
             mSelectedProfileReason = startReason;
-            launchVPN();
+
+            if (mSelectedProfile.mAlias != null) {
+                KeyChain.choosePrivateKeyAlias(this,
+                        new KeyChainAliasCallback() {
+                            @Override
+                            public void alias(@Nullable String s) {
+                                mSelectedProfile.mAlias = s;
+                                launchVPN();
+                            }
+                        },
+                        new String[]{"RSA", "EC"}, null,
+                        mSelectedProfile.mServerName,-1, mSelectedProfile.mAlias);
+            } else launchVPN();
+
         }
 
     }
diff --git a/main/src/main/java/de/blinkt/openvpn/api/AppRestrictions.java b/main/src/main/java/de/blinkt/openvpn/api/AppRestrictions.java
index 573dd070..05765e4e 100644
--- a/main/src/main/java/de/blinkt/openvpn/api/AppRestrictions.java
+++ b/main/src/main/java/de/blinkt/openvpn/api/AppRestrictions.java
@@ -142,7 +142,11 @@ public class AppRestrictions {
                 }
             }
             addProfile(c, ovpn, uuid, name, vpnProfile);
+            if (vpnProfile == null)
+                vpnProfile = pm.getProfileByName(name);
             addCertificateAlias(vpnProfile, certAlias);
+            pm.saveProfile(c, vpnProfile);
+
         }
 
         Vector<VpnProfile> profilesToRemove = new Vector<>();