I had a PFX file and needed to create KEY file for NGINX, so I did this:
openssl pkcs12 -in file.pfx -out file.key -nocerts -nodes
Then I had to edit the KEY file and remove all content up to -----BEGIN PRIVATE KEY-----
. After that NGINX accepted the KEY file. I used the CRT file as-is (already in PEM format).
Not sure if it matters, but I was using Windows Subsystem for Linux Beta (WSL on Windows 10).