Certificate Role or Custom Role created by an administrator as explained in Creating a role.

The default roles do not grant permissions to manage Bulk Certificates. These permissions must be manually selected when creating a Custom Role