Hi @KelvinT ,
I'm not sure if I fully understand your question ...
Remember that: (as an example) Administration > System > Certificates: Certificate Management > Certificate Signing Request - click the Generate Certificate Signing Requests (CSR) ... Usage: choose ISE Messaging Service.
Note: you must Enable the Certificate Authority at Administration > System > Certificates: Certificate Authority > Internal CA Settings, to be able to select the ISE Messaging Service.
Hope this helps !!!