Certificate profiles require there to be an Authentication profile in place in order for the keystore to be initialized for storing certificates on the device. Kiosk/Lockdown profiles also require Authentication so its common to find the Authentication configuration within the same profile as the Kiosk/Lockdown. I personally pull Authentication out and have it in its own profile that is applied at the highest level in the hierarchy so that it is not inadvertently removed by Kiosk Profile application changes in the future. The Android keystore can be finicky and seemingly once its initialized it can be corrupted or become unusable if you unapply and reapply Authentication. That has been my experience at least. 

In addition to these points, these are Zebra devices which means they also have StageNow and the MX layer available for configuration. If StageNow was used during enrollment and certificates were involved (eg. certificate based WiFi) then it is possible that the keystore has already been initialized, but by the MX layer and not by SOTI. In those cases I have found that you may have to continue to use MX to apply certificates to the devices in profiles distributed from SOTI rather than using the Certificate profile option.