As this is just a demo certificate you should do the following:
create your own private key and certificate signing request by using OpenSSL
get this certified by your CA-Vendor according to your company´s requirements
if you have a custom self-signed CA you can use this one instead
import this certificate and the corresponding CA to your MWS.
Remember that the CN-portion of the distinguished name of the certificate needs to match the URL (Host) which is used for access from the browser (set in MWS under Cluster Control → Frontend URL).
MWS 7.1 is using a combined JKS-Store, containing both parts, pk/certificate-pair and CA (the file is named demo.keystore under MWS/server/default/config).
MWS 8.x and above are using a PKCS12-Store for the pk/certificate-pair and a JKS-Store for the CA (these are a located under MWS/server/default/config/security).