Simplest is to generate a Letsencrypt certificate for your domain e.g. app.example.org and run:

$ openssl smime -sign -signer letsencrypt/live/app.example.org/cert.pem -inkey letsencrypt/live/app.example.org/privkey.pem -certfile letsencrypt/live/app.example.org/fullchain.pem -nodetach -outform der -in test.mobileconfig -out test-SIGNED.mobileconfig

Example mobileconfig file

• https://stackoverflow.com/a/55703927/6881647