https://docs.microsoft.com/en-us/azure/cloud-services/cloud-services-certs-create

https://docs.microsoft.com/en-us/azure/azure-api-management-certs

Attempting to upload a self-signed management certificate to the Azure Portal via the Subscriptions => Management Certificate pane. I get an error

The account I had was the Global Administrator and co-administrator but it still didn't work

Then went to Subscriptions Properties and noticed that the account that was listed as Account Admin and Service Admin was different to the failing account. Once I logged off and logged back in as the account listed in the subscription properties as the Account / Service Admin I could upload the certificate with no dramas.