How can I generate a batch of profiles and certificates for OS X Server Profile Manager?
You should be able to do all the configuration by group.

Add all the users into an OD group and then set all the WiFi preferences there. You should also be able to set a certificate for the group and allow the entire group to authenticate against the Radius server.

When it comes to setting up PKI then you enter into the dark realms of Kerberos. (Be very careful with your DNS or you will never return.)

This is a good guide http://yesdevnull.net/2013/10/os-x-mavericks-server-open-directory-master/

Reading everything Charles Edge writes is always worthwhile :- http://krypted.com/guides/mavericks-server/ - he literally wrote the book on Macs in the enterprise.

If you turn on the web server (which I assume you have for the Profile Manager) the front page provides a nice link to change passwords for OD users.