Hello,
It's not .pem or .pfx, but .crt. You can download it from the System → Administration → Access Control page:
Do i have to add the root ca to my browser?
Yes, otherwise the browser will not trust the certificate. It will be different for each browser, but there should tons of information on how to do it online.