pkcs转为linux下nginx PEM可识别的方式：

powershell:

Get-ChildItem env:
dir env:
$env:<变量名>

# Alias to your OpenSSL install
set-alias ossl "d:\utils\OpenSSL-Win32\bin\openssl" 

example:
--------------------------------------------------------------------------------------
# Update keypath to where your keys will be saved a nd their names.
$keypath = "D:\docs\certs\"
$key = $keypath + "letsencrypt.key"
$rsakey = $keypath + "letsencrypt_rsa.key"
$pem = $keypath + "letsencrypt.pem"

# Get the latest PFX file path
$pfx = $result.ManagedItem.CertificatePath

# Create the Key, RSA Key, and PEM file. Use the RSA Key & PEM for FileZilla
ossl pkcs12 -in $pfx -out $key -nocerts -nodes -passin pass:
ossl rsa -in $key -out $rsakey
ossl pkcs12 -in $pfx -out $pem -nokeys -clcerts -passin pass:

mycode with certcrypt web:
--------------------------------------------------------------------------------------
param($result)

set-alias ossl "D:\Program Files\openssl\openssl.exe"

$domain = $result.ManagedItem.RequestConfig.PrimaryDomain
$pfxpath = $result.ManagedItem.CertificatePath
$keypath = "C:\TEMP"
$key = $keypath + $domain + ".key"
$rsakey = $keypath + $domain + "_rsa.key"
$pem = $keypath + $domain + ".pem"

ossl pkcs12 -in $pfxpath -out $key -nocerts -nodes -passin pass:
ossl rsa -in $key -out $rsakey
ossl pkcs12 -in $pfxpath -out $pem -nokeys -clcerts -passin pass: