@marathon Probably an X509 or PEM certificate signing the root hash of the merkle tree (which is either the MF or the SF file) that you generate according to an algorithm.
It's probably a lot of work to build it up from standard tools (including openssl) but tit looks like uber has a re implementation on their github you can use.