Generate a complete, valid Samsung Tizen TV certificate profile — author and distributor, for up to 50 TVs — without Tizen Studio's Certificate Manager.
One command — the same one updates you later.
macOS and Linux:
curl -fsSL https://tizen-cert-cli.vercel.app/install.sh | shWindows (PowerShell):
irm https://tizen-cert-cli.vercel.app/install.ps1 | iexRead them first if you'd rather: install.sh · install.ps1. Or grab a binary from the releases page.
tizen-cert is an interactive terminal wizard, built with Bubble Tea, that does everything Tizen Studio's Certificate Manager does through dialogs — no tizen CLI, no manual DUID juggling — in a few keystrokes. The result drops straight into ~/tizen-studio-data/profile/profiles.xml, ready to sign apps.
- 📡 Detects TVs automatically — via
sdb, or accept DUIDs typed manually, or a TV IP address to connect on the spot. - ♻️ Renews expired profiles — point it at an existing
~/SamsungCertificate/<name>folder and it reuses the DUIDs from the old distributor certificate. - 🔐 Signs in for you — the same browser flow as Tizen Studio's certificate extension, with a manual token fallback for headless machines.
- 📜 Issues both certificates — author certificate + distributor certificate bound to the selected DUIDs, Public or Partner privilege.
- 📦 Writes everything ready to use —
author.p12,distributor.p12,.crt/.csrfiles under~/SamsungCertificate/<name>/, and registers the profile directly inprofiles.xml— notizenCLI required.
After that,
tizen package -t wgt -s <name> ...— on any machine with the generated folder andprofiles.xml— signs apps installable on the covered TVs.
- A Samsung account — sign-in happens in your browser. Partner-privilege certificates need that account enrolled in Samsung's partner program.
sdbon yourPATH, only if you want automatic TV detection (manual DUIDs work without it).- TVs in developer mode with the host IP registered — needed for detection and app installs, not for certificate generation itself.
Run
tizen-certBuilding from source instead?
make build # local binary ./tizen-cert
make all # dist/ binaries for linux/darwin (amd64+arm64) and windows (amd64)| Mode | What happens |
|---|---|
| Create a new profile | Select TVs / add DUIDs → choose privilege → name, e-mail, password → Samsung sign-in → done |
| Renew an existing profile | Pick the expired folder → same flow, with DUIDs pre-selected |
| Choose the active profile | Pick any registered profile → it becomes the one the Tizen tools sign with by default — no sign-in needed |
When another profile is already active, creating or renewing also asks whether the new profile should take over as the active one.
tizen-cert --version prints the build version.
| Topic | Detail |
|---|---|
| DUID sources | sdb shell 0 getduid (what the tool runs, also when you type a TV IP) or the TV's own menu — Support > Contact Samsung → "Unique Device ID". Not the duid field from the TV's REST API (http://<tv>:8001/api/v2/) — that's a different, SmartThings-space UUID, and it isn't valid for certificates. |
| Headless / SSH servers | Samsung posts the sign-in result to localhost:4794, so forward that port from your local machine first: ssh -L 4794:localhost:4794 user@server, then open the sign-in URL in your local browser — the flow completes by itself. The wizard detects SSH sessions, prints this command pre-filled, and c copies the URL to your local clipboard (OSC 52). |
More gotchas — Partner privilege, .p12 encoding, the 50-TV limit — are covered on the documentation site.
- tizen-cert-cli.vercel.app — quick start and FAQ on the homepage, full feature list and reference on the Details page (source in
docs-site/). - Samsung Certificate Issuance — Implementation Spec — the reverse-engineered API contract this tool implements, for anyone extending or auditing it.
MIT © gifflet