The method for obtaining a client certificate and key and set it using the KMS is different for each KMS. The certificate itself will be generated using OpenSSL, with some UID obtained from the KMS, for example:
openssl req -x509 -newkey rsa:4096 -keyout client-key.pem -out client-cert.pem -days 365 -nodes -subj '/CN=f283c99b-f173-4371-babc-572961161234'
Consult the specific KMS documentation to create a certificate and link it to the Content Software for File cluster in the KMS with sufficient privileges (encrypt/decrypt).
See SmartKey KMS to create a client certificate and key, and to assign a certificate for Content Software for File within SmartKey.