This script works when run from Script Console

import jenkins.model.*
import com.cloudbees.plugins.credentials.*
import com.cloudbees.plugins.credentials.domains.*
import com.cloudbees.plugins.credentials.impl.*

global_domain = Domain.global()

credentials = new CertificateCredentialsImpl(CredentialsScope.GLOBAL, "certificate-id", 'Certificate description', 'certificate-password', new CertificateCredentialsImpl.FileOnMasterKeyStoreSource('/path/to/certificate'))

credentials_store = Jenkins.instance.getExtensionList('com.cloudbees.plugins.credentials.SystemCredentialsProvider')[0].getStore()

credentials_store.addCredentials(global_domain, credentials)

but fails on initialisation

Failed to run script file:/var/jenkins_home/init.groovy.d/credentials.groovy
org.codehaus.groovy.control.MultipleCompilationErrorsException: startup failed:
/var/jenkins_home/init.groovy.d/credentials.groovy: 8: you tried to assign a value to the class 'credentials'. Do you have a script with this name?
@ line 8, column 1.
credentials = new CertificateCredentialsImpl(CredentialsScope.GLOBAL, 'certificate-id', 'Certificate description', 'certificate-password', new CertificateCredentialsImpl.FileOnMasterKeyStoreSource('path/to/certificate'))
^

1 error

at org.codehaus.groovy.control.ErrorCollector.failIfErrors(ErrorCollector.java:302)
at org.codehaus.groovy.control.CompilationUnit.applyToSourceUnits(CompilationUnit.java:861)
at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:550)
at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:499)
at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:302)
at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:281)
at groovy.lang.GroovyShell.parseClass(GroovyShell.java:731)
at groovy.lang.GroovyShell.parse(GroovyShell.java:743)
at groovy.lang.GroovyShell.evaluate(GroovyShell.java:578)
at jenkins.util.groovy.GroovyHookScript.execute(GroovyHookScript.java:122)
at jenkins.util.groovy.GroovyHookScript.execute(GroovyHookScript.java:113)
at jenkins.util.groovy.GroovyHookScript.run(GroovyHookScript.java:96)
at hudson.init.impl.GroovyInitScript.init(GroovyInitScript.java:42)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)
at hudson.init.TaskMethodFinder.invoke(TaskMethodFinder.java:106)
at hudson.init.TaskMethodFinder$TaskImpl.run(TaskMethodFinder.java:176)
at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:282)
at jenkins.model.Jenkins$7.runTask(Jenkins.java:904)
at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:210)
at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)