Hi all, correction on the post from yesterday.
The certificate is only required if you are using a Relay Rocket (aka Network Agent) to proxy traffic for Google and YouTube, otherwise the certificate is not required.
The guide r0cketbev sent is still the one to follow for iOS Smart Agent deployments though, but no certificate is required for Smart Agent only filtering.