The solution to this problem requires some coding. Usually the (big) user picture is stored in the file <adress of moodle-site>/user/pix.php/<id of user>/f1.jpeg , but not every user might have his own picture.

My basic idea is this (untested):
There is a function "print_user_picture" defined in the file lib/weblib.php. This function retreives the user picture and generates the complete webcode for web display including alt-text etc. Several report pages throughout moodle call this function.

Copy this function into the file mod/certificate/lib.php and rename it to user_picture_only (to avoid name collision). Now scrap unneeded parts of the function until it returns only the filename of the picture.

Edit the certificate.php of your desired certificate type and add a line like this:
$pdf->Image(user_picture_only($user->id, $course->id, $user->picture, 100, true), x, y, 100, 100);
Replace x and y with the desired coordinates on the certificate.
Change the three 100s by 35 if you want small pictures instead of big pictures.

I haven't tested it myself, but it might work. Good luck.