openssl pkcs12 -export -out /tmp/certificate.pfx -inkey /etc/letsencrypt/live/yourdomain.tld/privkey.pem -in /etc/letsencrypt/live/yourdomain.tld/cert.pem -certfile /etc/letsencrypt/live/yourdomain.tld/chain.pem
check whether the privkey signed your cert use these commands:
openssl x509 -noout -modulus -in /etc/letsencrypt/live/yourdomain.tld/cert.pem | openssl md5
openssl rsa -noout -modulus -in /etc/letsencrypt/live/yourdomain.tld/privkey.pem | openssl md5