If you want to get rid of self signed certificate, and the annoying security warnings in your browser, here is how to do it in 2 easy steps
1) create a new wallet in [OMS]/sysman/wallet/console.servername/, either with owm (gui) or with orapki (command line)
2) restart opmn http server
opmnctl stopproc process-type=HTTP_Server
opmnctl startproc process-type=HTTP_Server
Later, to access your Enterprise Manager Grid Control homepage, access the Apache server and not the oms upload server
opmnctl status -l
HTTP_Server http1:7779,http2:7201,https1:4445,https2:1159,http3:4890
https1 is Apache (4445) and https2 is Upload (1159)
So the url will be https://yourserver.dom.com:4445/em
Check note 1278231.1