Certificate based VPN

Hey Guys, I have remote VPN access setup on a pix using a group password which I would like to switch to be certificate based. Where I run into an issue is that I do not have a CA server, what I would like to do is have the pix act as the CA and sign the client certificates. Any thoughts?

Thanks