Your account does not have permission to create iOS distribution certificates

This seems to be a bug or poorly described feature in iTunes Connect & the Apple Developer portal.

I had a developer that joined my team, initially as a "member", but wasn't able to create certificates, even after giving him admin access. It turns out, that I believe we were only giving him admin access to Itunes connect, but not to the developer page.

The correct fix was to go to the developer portal, click the "People" tab (or go to this URL https://developer.apple.com/account/#/people/), remove his access, then use the Invite as Admins to add him to the account. He then had to go into Xcode and remove his developer account information, add it back in, and then he was finally able to upload builds to Testflight without this error.

This should be the user permission issue. Please note that only user with Team Agent role has permission to generate certificates for distribution of app outside the App Store. I believe, you are not in Team Agent role. Please double check your permissions.

You can even generate a Certificate Signing Request and send it to your Team Agent. Get back the created certificate from the Team Agent and use it to sign apps.

Based on your comment "Yes, we have a developer account for Team" I am guessing that what you have is an Enterprise Developer account. If you have a Enterprise DA you cannot upload to the apple store/test-flight. You will need to create a personal developer account for that. Enterprise accounts are only good for in house testing and not for external. That's why you are getting this error.