1. Generate the CSR
   1. openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr
2. Sign the CSR with your Certificate Authority
   1. Send the CSR (or text from the CSA) to VeriSign, GoDaddy, Digicert, internal CA, etc.
3. Download the CRT
   1. Grab a copy of the signed certificate from your CA and place both the signed certificate and the CA chain certificate inside the same folder as your csr
4. Create the PKCS#12 file (.pfx .p12)
   1. openssl pkcs12 -export -out nameofpkcsfilewearegoingtogenerate.pfx -inkey yourdomain.key -in publiccertfromCA.crt -certfile CAcertificatechain.crt
   2. Enter in a password that will be used to protect your PKCS file's private key

That's all that's to it!

Note: If you have multiple certificate authorities, you will have to create a certificate chain.  Use the following command for Step 4:

openssl.exe pkcs12 -export -in publiccertfromCA.crt -inkey yourdomain.key -name “MyCertYouCanChangeThisToWhateverItsAnAliasFriendlyName” -chain -CAfile certs.pem -passout pass:testpassword -out nameofpkcsfilewearegoingtogenerate.pfx

The certs.pem file will contain a list of your certificate authorities, starting from your intermediate authorities to the root authorities.

—–BEGIN CERTIFICATE—–
INTERMEDIATECERTIFICATEBASE64STUFFHERE.crt
—–END CERTIFICATE—–
—–BEGIN CERTIFICATE—–
ROOTCERTIFICATEBASE64STUFFHERE.crt
—–END CERTIFICATE—–