Another follow-up:
Using -W "" (no passsword) makes things work.
However:
-W is listed in help as an optional parameter:
Usage: pk12util -i importfile [-d certdir] [-P dbprefix] [-h tokenname]
[-k slotpwfile | -K slotpw] [-w p12filepwfile | -W p12filepw]
[-v]
Usage: pk12util -o exportfile -n certname [-d certdir] [-P dbprefix]
[-c key_cipher] [-C cert_cipher]
[-m | --key_len keyLen] [--cert_key_len certKeyLen] [-v]
[-k slotpwfile | -K slotpw]
[-w p12filepwfile | -W p12filepw]
If a password is required, perhaps there should be a prompt or a more
descriptive error message - not silent failure or cryptic "error"...
