verify-p12

View script Copied!

Quick smoke-test for Salesforce B2C Commerce WebDAV /Cartridges access. Sends a GET request to list cartridges and prints the HTTP status line plus directory links — if you see 200 OK and a list of URLs, your auth works and your WebDAV endpoint is reachable.

Supports both Bearer token auth (default) and Basic auth (via --basic). Optional .p12 mTLS mode lets you validate client certificate authentication at the same time, turning the test into a full "can I deploy code to this instance?" check. Useful after generating a fresh cert with generate-p12, or when troubleshooting certificate errors before attempting actual dav uploads.

If you need more than a cartridge listing — like verifying a specific code version path or seeing detailed directory structure — use propfind-p12 instead.

Quick start

$ verify-p12 dev01-web-example.demandware.net eyJhbGc...
GET https://dev01-web-example.demandware.net/on/demandware.servlet/webdav/Sites/Cartridges
HTTP/1.1 200 OK
/webdav/Sites/Cartridges/
/webdav/Sites/Cartridges/version1/
/webdav/Sites/Cartridges/active/

First line shows the URL being tested, then the HTTP status, then links to cartridge directories. If you see 200 OK and directory links, your token is valid and the WebDAV endpoint is accessible.

Common examples

Basic auth — for legacy username/password SFCC setups:

verify-p12 --basic dev01-web-example.demandware.net "jane.doe:s3cret!"

The credential is a single user:pass string (with a literal colon). The script base64-encodes it via openssl and sets the Authorization: Basic header. Colons inside the password are fine — only the first colon separates user from pass on the server side.

Test with mTLS certificate — validates both the token and the .p12 client cert:

verify-p12 staging-na01-example.demandware.net "$BEARER_TOKEN" cert-password

Looks for $USER-staging-na01-example.demandware.net.p12 in the current directory and uses it for mTLS. If the handshake succeeds and you get a 200, your certificate is ready for production use.

Basic auth with mTLS certificate:

verify-p12 --basic staging-na01-example.demandware.net "jane.doe:s3cret" cert-password

Specify a custom certificate path:

verify-p12 prod05-web-example.demandware.net "$TOKEN" password123 /secure/certs/my-cert.p12

Quick pre-deployment check — verify token + cert before running a code deploy script:

if verify-p12 "$HOSTNAME" "$TOKEN" "$CERT_PASS"; then
    echo "WebDAV access confirmed, starting deploy..."
else
    echo "Can't reach WebDAV, aborting"
    exit 1
fi

Debug 401 errors — if your deploy scripts are getting "unauthorized," run this to isolate whether the problem is the token or something else:

verify-p12 dev-xxxx-example.demandware.net "$TOKEN"
# Returns 401? Token is expired or invalid.
# Returns 200? Token is fine; problem is elsewhere (wrong path, cert issue, etc.)

Bearer auth vs Basic auth

SFCC WebDAV supports both Bearer token auth and Basic auth. Bearer is the modern path — tokens typically come from SCAPI Account Manager API or an OAuth client-credentials flow. Basic is the legacy path for username/password.

Pass --basic to switch modes. Output is identical between the two — only the Authorization header differs. Bearer is the default because it's what most SFCC workflows use today.

mTLS certificate validation

When you provide a p12_password, the script adds mTLS client certificate authentication to the request. The .p12 file must exist in your current directory (default name: $USER-hostname.p12, e.g. jane-dev01-web-example.demandware.net.p12).

The script uses curl's -k flag to skip CA verification, meaning it will succeed even if the server's certificate is self-signed or you haven't provided the SFCC CA cert. This is intentional — the goal is to validate that your client certificate works, not to verify the server's certificate chain.

If you need full CA validation (server cert + client cert), use propfind-p12 instead, which requires both the .p12 and the CA cert file.

Reference

All options

Flag	Description
`-b, --basic`	Use Basic auth instead of Bearer
`hostname`	Instance hostname (e.g. `dev01-web-example.demandware.net`)
`token`	Bearer token for authorization (default auth mode)
`user:pass`	Username and password for Basic auth (with `--basic`)
`p12_password`	(optional) Password for the `.p12` client certificate
`p12_file`	(optional) Path to `.p12` file (default: `$USER-hostname.p12`)
`-h, --help`	Display help

The first two positional arguments (hostname and credential) are required. The third and fourth are optional — if you omit p12_password, the script tests auth only, without mTLS.

Exit codes

Code	Meaning
0	Request succeeded (curl returned success); check output for HTTP status line
2	Usage error (missing required argument)
*	curl exit code on network or TLS failure (e.g. 35, 51, 58, 60)

A successful curl invocation (exit 0) doesn't guarantee 200 OK — you might get 401 Unauthorized or 403 Forbidden in the output. Check the HTTP status line to confirm access.

Common curl exit codes:

35 — SSL/TLS handshake failure (certificate problem, protocol mismatch)
51 — Server certificate verification failed (shouldn't happen due to -k, but possible if curl is misconfigured)
58 — Client certificate problem (.p12 can't be read, wrong password, or file doesn't exist)
60 — CA certificate problem (shouldn't happen with -k)

Dependencies

curl — must support .p12 certificates (compiled with OpenSSL or LibreSSL)
openssl — only required with --basic, used to base64-encode user:pass

Output format

The script prints three things:

Request line (stderr) — GET https://hostname/...
HTTP status line (stdout) — HTTP/1.1 200 OK or similar
Cartridge directory links (stdout) — WebDAV paths like /webdav/Sites/Cartridges/version1/

If you see the status line but no directory links, the request succeeded but the response body didn't contain the expected <a href="..."> tags. This might mean the WebDAV endpoint returned an error page, or the HTML structure changed.

Warnings

This script tests the root cartridges directory (/webdav/Sites/Cartridges), not a specific code version. If you need to test a particular version path (e.g. /Cartridges/version1/app_storefront_base/), use propfind-p12 instead.
Bearer tokens expire. If you get a 401 after this worked previously, regenerate your token.
The -k flag disables server certificate verification, so this script won't catch CA cert problems. If you need to validate the entire mTLS chain including the server's CA, use propfind-p12.
The .p12 file must be readable and password-protected. If curl reports "bad password" but you know the password is correct, the file might be corrupted or in the wrong format.