diff --git a/src/java/android/net/ipsec/ike/TunnelModeChildSessionParams.java b/src/java/android/net/ipsec/ike/TunnelModeChildSessionParams.java
index 10a23db..c8d31f6 100644
--- a/src/java/android/net/ipsec/ike/TunnelModeChildSessionParams.java
+++ b/src/java/android/net/ipsec/ike/TunnelModeChildSessionParams.java
@@ -95,29 +95,10 @@
     }
 
     /** Represents an IPv4 DHCP server request */
-    public interface ConfigRequestIpv4DhcpServer extends TunnelModeChildConfigRequest {
-        /**
-         * Retrieves the requested IPv4 DHCP server address
-         *
-         * @return The requested DHCP server address, or null if no specific DHCP server was
-         *     requested
-         * @hide
-         */
-        @Nullable
-        Inet4Address getAddress();
-    }
+    public interface ConfigRequestIpv4DhcpServer extends TunnelModeChildConfigRequest {}
 
     /** Represents an IPv4 DNS Server request */
-    public interface ConfigRequestIpv4DnsServer extends TunnelModeChildConfigRequest {
-        /**
-         * Retrieves the requested IPv4 DNS server address
-         *
-         * @return The requested DNS server address, or null if no specific DNS server was requested
-         * @hide
-         */
-        @Nullable
-        Inet4Address getAddress();
-    }
+    public interface ConfigRequestIpv4DnsServer extends TunnelModeChildConfigRequest {}
 
     /** Represents an IPv4 Netmask request */
     public interface ConfigRequestIpv4Netmask extends TunnelModeChildConfigRequest {}
@@ -141,16 +122,7 @@
     }
 
     /** Represents an IPv6 DNS Server request */
-    public interface ConfigRequestIpv6DnsServer extends TunnelModeChildConfigRequest {
-        /**
-         * Retrieves the requested IPv6 DNS server address
-         *
-         * @return The requested DNS server address, or null if no specific DNS server was requested
-         * @hide
-         */
-        @Nullable
-        Inet6Address getAddress();
-    }
+    public interface ConfigRequestIpv6DnsServer extends TunnelModeChildConfigRequest {}
 
     /** This class can be used to incrementally construct a {@link TunnelModeChildSessionParams}. */
     public static final class Builder extends ChildSessionParams.Builder {
diff --git a/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayload.java b/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayload.java
new file mode 100644
index 0000000..92f3207
--- /dev/null
+++ b/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayload.java
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.internal.net.ipsec.ike.message;
+
+import static com.android.internal.net.ipsec.ike.message.IkeCertPayload.CERT_ENCODING_LEN;
+import static com.android.internal.net.ipsec.ike.message.IkeCertPayload.CertificateEncoding;
+
+import android.net.ipsec.ike.exceptions.IkeProtocolException;
+
+import java.nio.ByteBuffer;
+
+/**
+ * This class represents a Certificate Request Payload
+ *
+ * <p>A Certificate Request Payload provides suggestion for an end certificate to select. Receiver
+ * of this payload is allowed to send an alternate. It is possible that there is a preferred CA sent
+ * in the IkeCertReqPayload, but an alternate is still acceptable.
+ *
+ * <p>IKE library will always ignore this payload since only one end certificate can be configured
+ * by users.
+ *
+ * @see <a href="https://tools.ietf.org/html/rfc7296#section-3.8">RFC 7296, Internet Key Exchange
+ *     Protocol Version 2 (IKEv2)</a>
+ */
+public class IkeCertReqPayload extends IkePayload {
+    /** Certificate encoding type */
+    @CertificateEncoding public final int certEncodingType;
+    /** Concatenated list of SHA-1 hashes of CAs' Subject Public Key Info */
+    public final byte[] caSubjectPublicKeyInforHashes;
+
+    /**
+     * Construct an instance of IkeCertReqPayload from decoding an inbound IKE packet.
+     *
+     * <p>NegativeArraySizeException and BufferUnderflowException will be caught in {@link
+     * IkeMessage}
+     *
+     * @param critical indicates if this payload is critical. Ignored in supported payload as
+     *     instructed by the RFC 7296.
+     * @param payloadBody payload body in byte array
+     * @throws IkeProtocolException if there is any error
+     */
+    public IkeCertReqPayload(boolean critical, byte[] payloadBody) throws IkeProtocolException {
+        super(PAYLOAD_TYPE_CERT_REQUEST, critical);
+
+        ByteBuffer inputBuffer = ByteBuffer.wrap(payloadBody);
+        certEncodingType = Byte.toUnsignedInt(inputBuffer.get());
+        caSubjectPublicKeyInforHashes = new byte[inputBuffer.remaining()];
+        inputBuffer.get(caSubjectPublicKeyInforHashes);
+    }
+
+    /**
+     * Encode Certificate Request Payload to ByteBuffer.
+     *
+     * @param nextPayload type of payload that follows this payload.
+     * @param byteBuffer destination ByteBuffer that stores encoded payload.
+     */
+    @Override
+    protected void encodeToByteBuffer(@PayloadType int nextPayload, ByteBuffer byteBuffer) {
+        encodePayloadHeaderToByteBuffer(nextPayload, getPayloadLength(), byteBuffer);
+
+        byteBuffer.put((byte) certEncodingType).put(caSubjectPublicKeyInforHashes);
+    }
+
+    /**
+     * Get entire payload length.
+     *
+     * @return entire payload length.
+     */
+    @Override
+    protected int getPayloadLength() {
+        return GENERIC_HEADER_LENGTH + CERT_ENCODING_LEN + caSubjectPublicKeyInforHashes.length;
+    }
+
+    /**
+     * Return the payload type as a String.
+     *
+     * @return the payload type as a String.
+     */
+    @Override
+    public String getTypeString() {
+        return "CertReq";
+    }
+}
diff --git a/src/java/com/android/internal/net/ipsec/ike/message/IkeConfigPayload.java b/src/java/com/android/internal/net/ipsec/ike/message/IkeConfigPayload.java
index bb5f9a3..778faa4 100644
--- a/src/java/com/android/internal/net/ipsec/ike/message/IkeConfigPayload.java
+++ b/src/java/com/android/internal/net/ipsec/ike/message/IkeConfigPayload.java
@@ -538,7 +538,6 @@
             super(CONFIG_ATTR_INTERNAL_IP4_DHCP, value);
         }
 
-        @Override
         public Inet4Address getAddress() {
             return address;
         }
@@ -572,7 +571,6 @@
             super(CONFIG_ATTR_INTERNAL_IP4_DNS, value);
         }
 
-        @Override
         public Inet4Address getAddress() {
             return address;
         }
@@ -979,7 +977,6 @@
             super(CONFIG_ATTR_INTERNAL_IP6_DNS, value);
         }
 
-        @Override
         public Inet6Address getAddress() {
             return address;
         }
diff --git a/src/java/com/android/internal/net/ipsec/ike/message/IkePayloadFactory.java b/src/java/com/android/internal/net/ipsec/ike/message/IkePayloadFactory.java
index 2f191d4..b50f093 100644
--- a/src/java/com/android/internal/net/ipsec/ike/message/IkePayloadFactory.java
+++ b/src/java/com/android/internal/net/ipsec/ike/message/IkePayloadFactory.java
@@ -60,7 +60,6 @@
                 int payloadType, boolean isCritical, boolean isResp, byte[] payloadBody)
                 throws IkeProtocolException {
             switch (payloadType) {
-                    // TODO: Add cases for creating supported payloads.
                 case IkePayload.PAYLOAD_TYPE_SA:
                     return new IkeSaPayload(isCritical, isResp, payloadBody);
                 case IkePayload.PAYLOAD_TYPE_KE:
@@ -71,6 +70,8 @@
                     return new IkeIdPayload(isCritical, payloadBody, false);
                 case IkePayload.PAYLOAD_TYPE_CERT:
                     return IkeCertPayload.getIkeCertPayload(isCritical, payloadBody);
+                case IkeCertReqPayload.PAYLOAD_TYPE_CERT_REQUEST:
+                    return new IkeCertReqPayload(isCritical, payloadBody);
                 case IkePayload.PAYLOAD_TYPE_AUTH:
                     return IkeAuthPayload.getIkeAuthPayload(isCritical, payloadBody);
                 case IkePayload.PAYLOAD_TYPE_NONCE:
diff --git a/tests/iketests/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayloadTest.java b/tests/iketests/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayloadTest.java
new file mode 100644
index 0000000..f859a82
--- /dev/null
+++ b/tests/iketests/src/java/com/android/internal/net/ipsec/ike/message/IkeCertReqPayloadTest.java
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.android.internal.net.ipsec.ike.message;
+
+import static com.android.internal.net.ipsec.ike.message.IkeCertPayload.CERTIFICATE_ENCODING_X509_CERT_SIGNATURE;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+
+import android.util.Pair;
+
+import com.android.internal.net.TestUtils;
+
+import org.junit.Test;
+
+import java.nio.ByteBuffer;
+
+public class IkeCertReqPayloadTest {
+    private static final int CERT_ENCODING_TYPE = CERTIFICATE_ENCODING_X509_CERT_SIGNATURE;
+    private static final int NEXT_PAYLOAD_TYPE = IkePayload.PAYLOAD_TYPE_AUTH;
+    private static final byte[] CERT_REQ_PAYLOAD =
+            TestUtils.hexStringToByteArray("27000019040d0a12bb1f98996563f15b10db95c67eea7990fa");
+    private static final byte[] CA_SUBJECT_PUBLIC_KEY_INFO_HASH =
+            TestUtils.hexStringToByteArray("0d0a12bb1f98996563f15b10db95c67eea7990fa");
+
+    @Test
+    public void testDecode() throws Exception {
+        Pair<IkePayload, Integer> pair =
+                IkePayloadFactory.getIkePayload(
+                        IkePayload.PAYLOAD_TYPE_CERT_REQUEST,
+                        false /*isResp*/,
+                        ByteBuffer.wrap(CERT_REQ_PAYLOAD));
+
+        IkeCertReqPayload certPayload = (IkeCertReqPayload) pair.first;
+        assertEquals(CERT_ENCODING_TYPE, certPayload.certEncodingType);
+        assertArrayEquals(
+                CA_SUBJECT_PUBLIC_KEY_INFO_HASH, certPayload.caSubjectPublicKeyInforHashes);
+
+        assertEquals(NEXT_PAYLOAD_TYPE, (int) pair.second);
+    }
+
+    @Test
+    public void testEncode() throws Exception {
+        Pair<IkePayload, Integer> pair =
+                IkePayloadFactory.getIkePayload(
+                        IkePayload.PAYLOAD_TYPE_CERT_REQUEST,
+                        false /*isResp*/,
+                        ByteBuffer.wrap(CERT_REQ_PAYLOAD));
+        IkeCertReqPayload certPayload = (IkeCertReqPayload) pair.first;
+
+        ByteBuffer byteBuffer = ByteBuffer.allocate(CERT_REQ_PAYLOAD.length);
+        certPayload.encodeToByteBuffer(NEXT_PAYLOAD_TYPE, byteBuffer);
+        assertArrayEquals(CERT_REQ_PAYLOAD, byteBuffer.array());
+
+        assertEquals(CERT_REQ_PAYLOAD.length, certPayload.getPayloadLength());
+    }
+}