One option would be to specify a custom start command for the application, and run the cert import command before the actual application start command.
Another option would be to extend the Java buildpack and either install the cert during the JVM setup (possibly by creating an additional "framework" component") or to have the buildpack set up the cert import in the start command automatically. See https://github.com/cloudfoundry/java-buildpack#configuration-and-extension for details on extending the buildpack.