Find the certificates already sitting in your Windows machine stores.
As pki-admin
Open /discovery
Click New scan
Fill 10.0.0.0/24 or host with "127.0.0.1"
Fill e.g. 9443, 8888 with "18490,18491,18492,18493"
Click Queue scan
wait
Click Refresh
Select "[object Object]" in Show risky endpoints only