How to create self signed certificate to sign cloudfront URLs

As far as I understand, according to the AWS best practices I shouldn't be using my main account for anything programmatic running on a server.

I want to create an IAM user and generate a key pair so it can be used as a trusted signer. I want to generate the key pair using a self signed certificate.

I followed the instructions on How to create cloudfront key pairs but they are not clear on how to use self signed certificates and how to upload them using the GUI.

Most tutorials only cover how to do this for "self".