The debug unlock certificate generation script in the SDK generates only the hex file and deletes the DER blob treating it as temporary file.

❯ python3 debug_unlock_x509_cert_gen.py -s am62px
Generating debug certificate for am62px ...
Debug unlock certificate created at ./soc/am62px/debug_unlock_cert_hex.h
❯ tree
.
├── debug_unlock_x509_cert_gen.py
└── soc
    ├── am62ax
    │   └── debug_unlock_cert_hex.h
    └── am62px
        └── debug_unlock_cert_hex.h 

This is sufficient for those who are using TISCI message for JTAG unlocking.

However, the TIFS supports JTAG unlocking via the CCS as well in which case the DER certificate blob is required.