On upgrading OES 23.4 or later server, oes-cert-mgmt.rpm is installed with the base rpms.
After upgrading to OES 23.4 or later, it is recommended to move services using self-signed certificates to eDirectory server certificate or any other CA singed certificate.
If services continue using self-signed certificate, you will not be able to take the full advantage of the tool. As the tool does not support self-signed certificates, on expiry, you will not be able to reconfigure the services to use a new self-signed certificate.