Thank you! This worked for me. I was an Admin in App Store Connect without access to certificates. After I was granted access to certificates by a colleague with that permission, I could then grant it to others.
Also, email from Apple today suggests that the permission can only be granted by others with the permission (see second paragraph). The email was received BEFORE I was granted access to certs, I'm including the first paragraph just in case folks find it interesting about upcoming changes to this Admin/Certs chaos.
You're currently assigned the Admin role without access to Certificates, Identifiers & Profiles for the development teams listed below. Starting August 12, 2019, all Admins must also have access to Certificates, Identifiers & Profiles. As a result, you'll be automatically assigned [demoted to?] the App Manager, Finance, and Customer Support roles. Please note that these roles will not allow you to generate API Keys or remove and restore apps.
To become an Admin with access to Certificates, Identifiers & Profiles, contact the Account Holder or another Admin on your team who has access to Certificates, Identifiers & Profiles to modify your role. You can learn about roles by visiting the support page.