Which keychain cert?

Yes, 2.

For a p12...

STEP 1: Create a “.certSigningRequest” (CSR) file

• Open Keychain Access on your Mac (found in Applications/Utilities)
• In the main Keychain Access window, make sure that you don’t have a private key already selected, otherwise this process will not work correctly
• From the toolbar, open Keychain Access > Preferences
• In the pop up window that appears, click the Certificates tab
• Set both “Online Certificate Status Protocol” and “Certificate Revocation List” to “Off”
• Close this window
• Back in the toolbar, open Keychain Access > Certificate Assistant > Request a Certificate From a Certificate Authority
• Enter the email address and common name that you used to register in the iOS Developer Program
  NOTE: Common name should be the name of the developer as it appears in your Apple Developer Account
• Leave the CA Email blank, and make sure “Saved to disk” is selected, and “Let me specify key pair information” is checked
• Click Continue
• Choose a filename & destination on your hard drive
  (e.g. “certificate.certSigningRequest”)
• Click Save
• In the next window, for “Key Size” choose “2048 bits”
• For “Algorithm” choose “RSA”
• Click Continue
• This will create and save your certSigningRequest file (CSR) to your hard drive. A public and private key will also be created in Keychain Access with the Common Name you entered earlier (e.g. Jo Smith)

STEP 2: Create the “.cer” file in your iOS Developer Account

• Log on to https://developer.apple.com
• Click “Certificates, Identifiers & Profiles”
• Click “Provisioning Profiles” from the left-hand column
• In the “Certificates” section at the top of the left-hand panel, click “Production”
• Click the “Add” ➕ button at the top-right of the main panel
• In the main panel, under Production, Choose “App Store and Ad Hoc”
• Click Continue
• Click “Choose File” & find the CSR file you’ve just made from your hard drive
• Click Generate and wait for the file to process
• Click Download to get the file, and then click the Done button at the bottom once the download has finished

STEP 3: Install the .cer and generate the .p12

• Find the .cer file you’ve just downloaded and double-click. If the certificate hasn’t automatically been installed, you will see an 'add cert' dialog' (otherwise, skip the next two steps):
• Make sure the drop-down is set to “login”
• Click Add
• Open up KeyChain Access again
• Find the two profiles you created in Step 1 (with the iOS Developer common name)
• You should now be able to expand the “private key” profile, which should show the certificate you just added
• Select only these two items (not the public key), by holding SHIFT and clicking both items
• Right click and click “Export 2 items…” from the popup
• In the next window, make sure the file format is a “.p12” and choose a filename and destination on your hard drive
• Click Save
• Finally, you’ll be prompted to set a password – but leave these both blank
• Click OK
  NOTE: You may be asked for the administrator password of the computer at this stage (possibly twice as there are two files to export), if you do, enter the password and click OK
• You should now have a .p12 file in your chosen location on your hard drive

-=- note these directions were current as of 1.2015 - tools, UI, etc. may have changed since, but the basic process should still apply.