Docs:
```
-nocerts      No certificates at all will be output.
-clcerts      Only output client certificates (not CA certificates).
-nokeys       No private keys will be output.
-nodes        Don't encrypt the private keys at all.
```


Examples:
```sh
# Only CA-certs:
openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -out ${cert}-ca.pem

# Only cert:
openssl pkcs12 -in ${cert}.pfx -clcerts -nokeys -out ${cert}.pem

# Only key:
openssl pkcs12 -in ${cert}.pfx -nocerts -out ${cert}.key

# CA+cert: 
openssl pkcs12 -in ${cert}.pfx -nodes -nokeys -cacerts -clcerts -out ${cert}-full.pem

# Combine CA-cert and cert, if only got split parts:
cat  ${cert}.pem ${cert}-ca.pem > ${cert}-full.pem

# Remove passphrase:
openssl rsa -in ${cert}.key -out ${cert}.key

# Add passphrase:
openssl rsa -aes256 -in ${cert}.key -out ${cert}.key
```