Work with PFX
Unpack
Export the private key
openssl pkcs12 \
-in <PfxFilename>.pfx \
-out <PrivateKeyFile>.pem \
-password pass:'<SnipPfxPassword>' \
-passout pass:'<SnipPemPrivateKeyEncryptionPassword>' \
-nocerts
Export the client certificate
openssl pkcs12 \
-in <PfxFilename>.pfx \
-out <ClientCertificateFile>.pem \
-clcerts \
-nokeys
openssl pkcs12 \
-in <PfxFilename>.pfx \
-out <CACertificateFile>.pem \
-cacerts \
-nokeys
Pack
openssl pkcs12 \
-in <ClientCertificateFile>.pem \
-inkey <PrivateKeyFile>.pem \
-certfile <CACertificateFile>.pem \
-out <PfxFilename>.pfx \
-passout pass:'<SnipPfxPassword>' \
-passin pass:'<SnipPemPrivateKeyEncryptionPassword>' \
-export