Simplest is to generate a Letsencrypt certificate for your domain e.g. app.example.org and run:
$ openssl smime -sign -signer letsencrypt/live/app.example.org/cert.pem -inkey letsencrypt/live/app.example.org/privkey.pem -certfile letsencrypt/live/app.example.org/fullchain.pem -nodetach -outform der -in test.mobileconfig -out test-SIGNED.mobileconfig