App certificates are used to verify the authenticity of apps on devices. Apps can be "spoofed," meaning a device can be fooled in to thinking one app is being used when another one really is. If you have policies that include app-based filtering, certificates insure that the apps you define in policy filters are actually the ones affected by these policies.
Part of the app development process includes digitally signing the app to accurately identify the developer. The process includes the creation of a private and a public key. The public key for each Android app is put into a certificate. That information, along with the app's name and app ID, is stored within the app when it is distributed.
When you add a data filter with App ID as one if its criteria, and when you enter the app's ID, if the certificate for that app is found in the Certificates library, the certificate is used automatically for identification and security. If no certificate is available, apps will be identified only by app ID, and the authentication of apps used on your customer devices cannot be guaranteed.