not familiar with Expressway so might be off the mark here but if you are looking to upload a Certificate Authority (CA) root certificate and application certificate say for use by Phone Devices with CAPF to sign LSC X.509 this is detailed in "Cisco Unified Communications Operating System Administration Guide, Release 9.1(1)"
"Cisco Unified Communications Operating System supports certificates that a third-party CA issues with PKCS#10 Certificate Signing Request (CSR)."
Hope this helps.
thanks for the hint but the key point here is to generate the private key, the public key and the CSR external to the UCM and upload the first two ones (pub key as a CA signed certificate, of course) to the UCM. To generate the CSR in the UCM and sign it externally, is not an option in our case.