I went through this when trying to get a clientcert and private key out of a keystore.
The link above posted by welsh was great, but there was an extra step on my redhat distribution. If curl is built with NSS ( run curl --version to see if you see NSS listed) then you need to import the keys into an NSS keystore. I went through a bunch of convoluted steps, so this may not be the cleanest way, but it got things working
So export the keys into .p12
keytool -importkeystore -srckeystore $jksfile -destkeystore $p12file \ -srcstoretype JKS -deststoretype PKCS12 \ -srcstorepass $jkspassword -deststorepass $p12password -srcalias $myalias -destalias $myalias \ -srckeypass $keypass -destkeypass $keypass -noprompt
And generate the pem file that holds only the key
echo making ${fileroot}.key.pem openssl pkcs12 -in $p12 -out ${fileroot}.key.pem \ -passin pass:$p12password \ -passout pass:$p12password -nocerts
mkdir ~/nss chmod 700 ~/nss certutil -N -d ~/nss
pks12util -i <mykeys>.p12 -d ~/nss -W <password for cert >
Now curl should work.
curl --insecure --cert <client cert alias>:<password for cert> \ --key ${fileroot}.key.pem <URL>
As I mentioned, there may be other ways to do this, but at least this was repeatable for me. If curl is compiled with NSS support, I was not able to get it to pull the client cert from a file.