Permissions to create certificate
There is a CREATE CERTIFICATE permission:

GRANT CREATE CERTIFICATE TO [user_or_role_name];


Here is a simple test:

USE [tempdb];

CREATE USER [t] WITHOUT LOGIN;

EXECUTE AS USER = 't';

PRINT 'Before GRANT:';
CREATE CERTIFICATE [tt] WITH SUBJECT = 'test';

REVERT;

GRANT CREATE CERTIFICATE TO [t];

EXECUTE AS USER = 't';

PRINT 'After GRANT:';
CREATE CERTIFICATE [tt] WITH SUBJECT = 'test';

REVERT;

DROP USER [t];


Which returns (in the "Messages" tab):


  Before GRANT:
  Msg 15247, Level 16, State 1, Line 15
  User does not have permission to perform this action.
  After GRANT:
  Msg 15581, Level 16, State 1, Line 26
  Please create a master key in the database or open the master key in the session before performing this operation.