Antes
descomentar em /etc/ssl/openssl.cnf
[provider_sect]
default = default_sect
legacy = legacy_sect

[default_sect]
activate = 1

[legacy_sect]
activate = 1


openssl pkcs12 -legacy -in arquivo.pfx -nodes -out cert-decrypted.tmp
openssl pkcs12 -in cert-decrypted.tmp -export -out CERTHEFLO.pfx
rm cert-decrypted.tmp
sudo chmod 777 -R CERTHEFLO.pfx