Hello Sudarat,
The KBA link is correct - do you have an SAP Support Portal login?
--
You shouldn't ever need to distribute createcert.exe to customers.
createcert is used to generate the private key, and optionally sign it or create a signing request. In the case of a third-party Certificate Authority (CA), you create a signing request and have the CA sign it. You then use the private identity file returned to you by the CA (with the full CA chain) on the server-side, and use the public certificate of the CA with your clients. You can generally download the public certificate from the CA's website.
Regards,
Jeff Albion
SAP Active Global Support