The X.509 Certificate Interface is the recommended way to pass a certificate to the Logon plugin that comes from a third part MDM solution. I have not myself used AirWatch but there is a step by step example demonstrating how to create the simplest type of certificate provider which is a file provider here.
Getting Started with Kapsel - Appendix D -- Security Part 2
Hope that helps,
Dan van Leeuwen