Doesn’t macOS have a way to generate cert.pem from the keychain?