You can use the OpenSSL and keytool programs to create requests that you can then send to a CA to create signed certificates. Or, you can obtain signed certificates entirely provided by the CA.
For IBM® EMM applications written in C++, obtain a certificate in PEM format.
For all other IBM® EMM applications, obtain a certificate in JKS format.
