$ tizen-cert
for Samsung Tizen TVs

TV certificates, without the Certificate Manager

An interactive CLI that generates a complete, valid Samsung certificate profile — author + distributor for up to 50 TVs — and registers it ready to sign. No Tizen Studio required. Renewals keep your DUIDs.

$ curl -fsSL https://tizen-cert-cli.vercel.app/install.sh | sh

One command installs it — and updates it later. Read install.sh · install.ps1

Download a binary instead View source

A real recording, not a mock-up — the wizard as it runs in the terminal.

How it works

One wizard, from TVs to a signing-ready profile

The same issuance flow as Tizen Studio's own certificate extension — the real Samsung servers, the real formats — driven from your terminal.

1

Pick your TVs

Connected TVs are detected via sdb and their DUIDs fetched automatically. No sdb? Type a TV's IP to connect on the spot, or paste DUIDs from the TV menu.

2

Or renew what you have

Point it at an expired profile in ~/SamsungCertificate — the DUIDs are read out of the old distributor certificate and pre-selected.

3

Choose privilege & details

Public or Partner, profile name, e-mail, password — with Samsung's password policy enforced up front, not after a failed round-trip.

4

Sign in to Samsung

Your browser opens the Samsung account sign-in; a local callback catches the token — exactly like the official extension. Headless fallback included.

5

Everything lands ready to use

~/SamsungCertificate/<name>/ with both .p12 bundles (Samsung CAs embedded), and the profile registered in profiles.xml — tizen package -s <name> just works.

✓

Valid means valid. Certificates are issued by Samsung's own servers against your Samsung account — the tool replicates the official extension's flow (v3 APIs, October 2025), it doesn't fake certificates locally.

Quick start

From download to signed app

terminal
# 1. install (macOS/Linux — on Windows: irm https://tizen-cert-cli.vercel.app/install.ps1 | iex)
$ curl -fsSL https://tizen-cert-cli.vercel.app/install.sh | sh

# 2. run the wizard — it does the rest
$ tizen-cert

# 3. sign and install with the profile it registered
$ tizen package -t wgt -s lab-tvs -- ./app
$ tizen install -n app.wgt -s <TV_IP>:26101

FAQ

The questions that cost us an afternoon each

Can I read the DUID from the TV's REST API instead of sdb?
No — and this one is a trap. The duid field served on http://<tv>:8001/api/v2/ is a SmartThings UUID, a different identifier space with no known conversion to the certificate DUID. Use sdb shell 0 getduid (the tool does this for you) or the TV menu: Support → Contact Samsung → Unique Device ID.
Why do I need a Samsung account?
Valid certificates are signed by Samsung's CA — they can only be issued by Samsung's servers, authenticated with a Samsung account. That's true of Tizen Studio too; this tool simply drives the same flow from the terminal.
Does it work on a headless server?
Yes — the trick is a port forward. Samsung posts the sign-in result to localhost:4794, so run ssh -L 4794:localhost:4794 user@server from your local machine (the wizard detects SSH sessions and prints this command pre-filled), then open the sign-in URL in your local browser: the token travels through the tunnel and the flow completes by itself. c copies the URL to your local clipboard over SSH (OSC 52), and m remains as a last-resort manual token entry.
My signing fails with "Invalid password" — is my password wrong?
Probably not. Tizen's Java signer rejects modern AES-encrypted PKCS#12 files and misreports it as a password error. This tool always emits legacy-3DES bundles precisely to avoid that failure mode.
What about Partner-level privileges?
Selectable in the wizard. Issuance succeeds only if your Samsung account is enrolled in the partnership program — otherwise Samsung's server refuses, and the error is surfaced as-is.