PFX to PEM for Linux Azure CLI

In order to use a service principal for the Azure CLI on Linux via a certificate instead of password, the file must be a "certificate" (not private key or public key). Given a .PFX file, to convert it to the proper certificate file use:

openssl pkcs12 -in $CertName.pfx -clcerts -nodes -out $CertName.pem

If you try to feed it something else you're likely to get the very unhelpful error:

Traceback (most recent call last):
  File "/usr/lib64/az/lib/python2.7/site-packages/knack/cli.py", line 206, in invoke
    cmd_result = self.invocation.execute(args)
  File "/usr/lib64/az/lib/python2.7/site-packages/azure/cli/core/commands/__init__.py", line 560, in execute
    raise ex
Error: [('PEM routines', 'get_name', 'no start line')]