Embedding certificate data into a fdesetup plist file

One of the mysteries of the fdesetup man page has been the Certificate key of the INPUT PROPERTY LIST example.

The function seemed clear enough; you could populate that key with the institutional recovery key’s public key. The problem was how to properly export the certificate into a text format and get it into that plist key. That part did not seem to be documented anywhere that I could find. After doing some asking around with our Apple SE, see below the jump for a way to get that certificate information into this plist key.