Go to Settings > Security > Install from storage.
install programatically can be achived by from command line, by moving certs to
replacing bks file solely is useless, it has to be combined with the password
set proxy programatically
make certs like this tutorial, http://forum.xda-developers.com/google-nexus-5/help/howto-install-custom-cert-network-t2533550 but push it to /data/misc/user/0/cacerts-added/