Question
How do I obtain a TLS certificate for Remote Configuration when provisioning AMT systems with Out of Band Management?

Answer
You can obtain a valid certificate from a public Certification Authority, such as a Symantec wildcard certificate

Symantec certificates have been supported since the inception of Remote Configuration in Intel AMT systems.

Here is one more helpful link: http://communities.intel.com/docs/DOC-1277