Convert PFX to PEM with Key INCLUDING INTERMEDIATE certificates

Question

I have a PFX that I want to convert to a CRT and Key or PEM and Key to install on an NGINX endpoint. When I import the pfx to my cert store on my windows machine it creates the certificate, the intermediate chain, and the root CA.

If I take that PFX and run the following openssl commands I and bind it to the endpoint, I don't get all the certificates in the chain:

openssl pkcs12 -in ./GoDaddy.pfx -clcerts -nokeys -out pcc.crt -nodes -nokeys

openssl pkcs12 -in ./GoDaddy.pfx -nocerts -nodes -out pcc.rsa -nodes -nokeys

Is there a switch or command I can run to convert the PFX to a crt / rsa or pem /key with all of the certificates up the chain to the root CA?

Solution

Since you want everything, you just need to reduce the number of restrictions you are asking for.

so:

openssl pkcs12 -in ./GoDaddy.pfx -out ./GoDaddy.pem

If you read the documentation you will see what you are asking for:

-nocerts

No certificates at all will be output.

-clcerts

Only output client certificates (not CA certificates).

-nokeys

No private keys will be output.

-nodes

Don't encrypt the private keys at all.