generate-p12

View script URLhttps://toolio.sh/generate-p12Installcurl -fsS https://toolio.sh/get | bash -s -- generate-p12Runcurl -fsS https://toolio.sh/generate-p12 | bash -s -- [args]Copied!

Generate a PKCS#12 (.p12) client certificate for Salesforce B2C Commerce staging sandbox code uploads that require mutual TLS authentication.

When you need to upload code to an SFCC staging instance with MFA enabled, Business Manager won't accept username/password alone — you need a client certificate. This script takes a CA cert bundle (provided by Salesforce or your admin) and generates a .p12 file you can import into your system keychain and configure in UX Studio or your WebDAV client.

It's an interactive wrapper around openssl that handles the three-step dance: generate a CSR and private key, sign it with the CA, and bundle everything into a password-protected .p12 file.

Quick start

Run from the directory where you unzipped the CA cert bundle (the files ending in _01.crt, _01.key, _01.txt, and .srl):

$ generate-p12
BM Hostname: cert.staging.example-realm.demandware.net

Using these files in /path/to/cert-bundle:
  cert.staging.example.realm.demandware.net_01.crt
  cert.staging.example.realm.demandware.net_01.key
  cert.staging.example.realm.demandware.net_01.txt
  cert.staging.example.realm.demandware.net.srl
  jklein-cert.staging.example.realm.demandware.net.req
  jklein-cert.staging.example.realm.demandware.net.key
  jklein-cert.staging.example.realm.demandware.net.pem
  jklein-cert.staging.example.realm.demandware.net.p12

Years until expiration: 1

[... openssl prompts for CSR fields (Country, State, Common Name, etc.) ...]

Created CSR:
/path/to/cert-bundle/jklein-cert.staging.example.realm.demandware.net.req
Created private key:
/path/to/cert-bundle/jklein-cert.staging.example.realm.demandware.net.key

Created X.509 intermediate certificate:
/path/to/cert-bundle/jklein-cert.staging.example.realm.demandware.net.pem

NOTE: This encrypts the client certificate itself, so that it cannot be used without this password.
secure prompt: no text will appear as you type
Enter Export Password:
Verifying - Enter Export Password:

Created PKCS12 client certificate:
/path/to/cert-bundle/jklein-cert.staging.example.realm.demandware.net.p12

Finished successfully. Full path to p12:
/path/to/cert-bundle/jklein-cert.staging.example.realm.demandware.net.p12

Common examples

Run from a different directory:

generate-p12 /path/to/cert-bundle

Flexible hostname formats — provide the hostname however you like; the script normalizes it:

# These all produce the same cert:
cert.staging.example.realm.demandware.net
example.realm.demandware.net
example.realm
example-realm
example_realm

The script strips any existing instance type prefix (production., development., staging.), converts hyphens and underscores to dots, prepends cert.staging., and appends .demandware.net.

What gets generated

The script creates four new files in the cert bundle directory, all prefixed with $USER-<hostname>:

The .p12 file is what you'll import and use. The others are intermediate artifacts kept for reference.

Suffix auto-detection

CA cert bundles often contain multiple generations of certificates with numeric suffixes: _01, _02, _03, etc. The script automatically finds the highest-numbered suffix that has all three required files (.crt, .key, .txt).

If you have:

cert.staging.example.realm.demandware.net_01.crt
cert.staging.example.realm.demandware.net_01.key
cert.staging.example.realm.demandware.net_01.txt
cert.staging.example.realm.demandware.net_02.crt
cert.staging.example.realm.demandware.net_02.key
cert.staging.example.realm.demandware.net_02.txt
cert.staging.example.realm.demandware.net.srl

It will use _02 (the latest complete bundle).

Prerequisites

You need a CA cert bundle provided by Salesforce or your sandbox admin. It should contain:

• <hostname>_XX.crt — CA certificate
• <hostname>_XX.key — CA private key
• <hostname>_XX.txt — CA password file
• <hostname>.srl — CA serial number file (no numeric suffix)

These are typically provided as a .zip you unzip into a dedicated directory.

Reference

All options

What you'll be prompted for

1. BM Hostname — the Business Manager hostname for your staging instance (any format works; see "Common examples" above)
2. Years until expiration — how long the certificate should be valid (must be a positive integer)
3. CSR fields — openssl will prompt for Country, State/Province, Locality (City), Organization, Organizational Unit, Common Name, and Email. These go into the certificate metadata
4. Export password — encrypts the final .p12 file (you'll need this password when importing the certificate)

Exit codes

Dependencies

• openssl (required)

Warnings

The export password is critical — it encrypts the .p12 file. If you lose it, you'll need to regenerate the certificate. Choose something you can remember or store in a password manager.

Keep the .p12 and .key files secure — they're authentication credentials. Don't commit them to git or share them publicly.

Check your cert bundle suffix — if the script reports "No complete cert bundle found", make sure all three files (_XX.crt, _XX.key, _XX.txt) exist for at least one suffix, plus the .srl file with no suffix.