it lives in system.app under general>profiles.
once you install the user certificate via iPCU or your preferred MDM provider, open pulse and edit the configuration and choose the certificate to use
