You can use RACF to create self-signed certificates (see section 3.4 a) or request a well-known certificate from a Certificate Authority and add it to RACF (see section 3.4 b).
For information on RACF commands, see z/OS Security Server RACF Security Administrator's Guide and z/OS Security Server RACF Command Language Reference in References.