A standard server certificate is needed. You can create the Certificate Signing Request (CSR) and later import the received certificate via Administration System Certificates.
You need to decide whether it makes more sense to use a wildcard certificate (with Subject Alternative Names or SANs for each ISE server/persona) or unique individual server certificates for your environment, mostly depending on whether you have a setup with multiple PSNs.
