Go to https://my_iseries:2010/QIBM/ICSS/Cert/Admin/qycucm1.ndm/main0 using the user login for which you want to create the certificate.
Then select "Create Certificate". The login name will be the user under you connected to the web site.
Then click on "install certificate". This will install the certificate into the web browser. Then you can export it into a portable format if needed.
If you created the X.509 registry and specified the LDAP location the DCM configuration, the EIM settings is automatically updated. Note: an EIM mapping MUST exist for this user before doing this (with an i5/OS target equal to that user).