You have to create a Certificate Signing Request (CSR) first. Use the button "Enroll ASA SSL with Entrust". You can disregard the Entrust bit - the button will create a standard CSR that can be enrolled with any CA.
When you do that. it will prompt you to either use an existing key on the ASA or create a new one. You should make sure you use a key of 2048-bit length (or greater). Create one if the existing available key is any smaller than 2048 bits.
You then provide the CSR (file or text) to the client and they enroll it with their CA. Once they give you the certificate, you install it. Since you have created the CSR earlier, it will show in ASDM as "pending" under the certificate expiry date and the "Issued to" name will be in parentheses. Select that entry and click "Install".
You now have an installed signed identity certificate that can be bound to the interface where you provide SSL VPN service (typically the outside).
The process does not automatically install the issuing CA's root and/or any intermediate certificates. You should add those separately under the "CA Certificates" section. You should also remove support for any old ciphers like RC4 from the SSL section.
If you complete all of the above properly, you can run Qualys SSL checker and should see the grade as A-. (There are a few things Cisco doesn't do by design that Qualys checks for - sort of a philosophical difference in best practices.)
https://www.ssllabs.com/ssltest/index.html
