===== Convert to PFX =====
<code>
openssl pkcs12 -in file.pfx -out file.nokey.pem -nokeys

openssl pkcs12 -in file.pfx -out file.withkey.pem

openssl rsa -in file.withkey.pem -out file.key

cat file.nokey.pem file.key > file.combo.pem

The 1st step prompts you for the password to open the PFX.

The 2nd step prompts you for that plus also to make up a passphrase for the key.

The 3rd step prompts you to enter the passphrase you just made up to store decrypted.

The 4th puts it all together into 1 file.
</code>

===== certbot debian =====
<code>

sudo apt install certbot python3-certbot-apache

sudo certbot certonly -a apache --certname yourdomain.com -d yourdomain.com



sudo nano /etc/letsencrypt/renewal/yourdomain.com.conf

[renewalparams]
authenticator = apache
installer = none
renew_hook = systemctl reload apache2


Without apache:

[renewalparams]
# ... other existing settings ...
pre_hook = systemctl stop apache2
post_hook = systemctl start apache2
renew_hook = systemctl restart webmin

Webmin:

sudo nano /etc/webmin/miniserv.conf

ssl=1
keyfile=/etc/letsencrypt/live/yourdomain.com/privkey.pem
certfile=/etc/letsencrypt/live/yourdomain.com/fullchain.pem
extracas=/etc/letsencrypt/live/yourdomain.com/chain.pem


</code>