Data sets associated with Top Secret commands such as a TSS gencert, genreq or export that put a certificate into a data set cannot be pre-allocated. They will be allocated by issuing the command(s).
If you are not issuing Top Secret commands to put the certificate in a data set then you have to allocate the data set.
The data set needs the following attributes:
DSORG = PS and RECFM = VB.
Any other attributes are not specific and can usually take a default value. Only the two above are mandatory values.