You can create self-signed service or non-service certificates in NSX Manager. You can also import a signed certificate for NSX-generated CSRs.