diff --git a/.gitignore b/.gitignore
index ca35fa303eb10a162c05c74919faa56dc0a91e1a..4eae557109ab924c6f39b6e7d16af00eef5f4ae1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ keys/*
 openssl.cnf
 CA.key
 CA.crt
+CA.p12
diff --git a/README.rst b/README.rst
index de5b017921f616954ff9d2e82668f4a4e98ee4a6..6af8d0fb4b00338a8f18fb0c2d07c5a1ac249f63 100644
--- a/README.rst
+++ b/README.rst
@@ -86,4 +86,4 @@ at: https://www.shore.co.il/cgit/.
 TODO
 ----
 
-Nothing to see here.
+- PKCS12 file for browser import (also tests).
diff --git a/ssl-ca b/ssl-ca
index 61bcf1e3fa9b4cc5cbca477948db801d7d18d250..49a036b327c72a303f20e6104e6e6710f32dfeaf 100755
--- a/ssl-ca
+++ b/ssl-ca
@@ -62,6 +62,12 @@ init () {
         -keyout CA.key \
         -extensions v3_ca \
         -out CA.crt
+    openssl pkcs12 \
+        -export \
+        -in CA.crt \
+        -inkey CA.key \
+        -out CA.p12 \
+        -passout pass:
 }
 
 sign_key () {