How do you configure ASA5505 to be its own CA?

What are the correct steps to configuring an ASA5505 to be its own CA without a Microsoft CA being available and giving users the ability to self-enroll?

Specifically, I would like our ASA to use certificates for both VPN and SSL connections and I've managed to configure the Local Certificate Authority via ASDM but I cannot figure out what the URL the ASA uses for users to download their certificates is.

Also, do you need separate key pairs for VPN and SSL? Can you use certificates for SSH connections to the ASA?

Thank you in advance.