Do we need to have certificate to use the policy file for webservice security ?

Do we need to have certificate to use the policy file for webservice security .

IF YES ,How to generate them ?