This creates a signing request, to be sent to your trusted third party, not a certificate. The TTP will provide the certificate. Also using the same name for two outputs, isn’t going to work well. Even if both get written, you should never have a clear text private key in the same file as a certificate, or in what you send to a TTP.
Asterisk does include scripts for generating enterprise level CAs, although they don’t follow best practice on key safety. Note that, although people talk about self signed certificates, the only self signed ones, with these, are the CA ones, not the ones that get used by clients.
I haven’t analysed your certificate sharing requirements, although I note that VoIP systems are often configured to be rather lax on authentication, even though that is why certificates exist.
This is going to be a niche topic, and is more openhab, than Asterisk, but you will be very lucky to find anyone with knowledge of openhab, here.
The messages about self signed is either misleading, or you have installed the wrong certificate. There are two certificates associated with Asterisk, a CA one, which is self signed (all root certificates are self signed, even those from commercial CAs), and the certificate for Asterisk itself. Whilst “self signed” is often misused to refer to certificates signed by an enterprise CA, this is never self signed, if you ran the creation process correctly.