Docs:
```
-nocerts      No certificates at all will be output.
-clcerts      Only output client certificates (not CA certificates).
-nokeys       No private keys will be output.
-nodes        Don't encrypt the private keys at all.
```


Examples:
```sh
# Only CA-certs:
openssl pkcs12 -in ${file}.pfx -nodes -nokeys -cacerts -out ${file}-ca.pem

# Only cert:
openssl pkcs12 -in ${file}.pfx -clcerts -nokeys -out ${file}.pem

# Only key:
openssl pkcs12 -in ${file}.pfx -nocerts -out ${file}.key

# Combine CA-cert and cert to full:
cat  ${file}.pem ${file}-ca.pem > ${file}-full.pem

# Remove passphrase:
openssl rsa -in ${file}.key -out ${file}.key

# Add passphrase:
openssl rsa -aes256 -in ${file}.key -out ${file}.key
```

Usecase with SED to remove bag attributes and only end up with clear certificate blobs:

```sh
# unecrypted key
openssl pkcs12 -in ${file}.pfx -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > ${file}.key
# client certificate
openssl pkcs12 -in ${file}.pfx -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}.pem
# CA
openssl pkcs12 -in ${file}.pfx -cacerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${file}-ca.pem
```