Cockpit will load a certificate from the /etc/cockpit/ws-certs.d directory. It will use the first file with a .cert extension in alphabetical order.
/etc/cockpit/ws-certs.d
.cert
If no certificate is found, a self-signed certificate is created.