I'm not sure what Azure means by 'without a password'. OpenSSL can create a PKCS12 with the contents unencrypted, but it still has a PBMAC which uses a password -- but which a reader that violates the standard can ignore.I don't know how I missed it, but since 1.0.0
-nomac DOES avoid the PBMAC. To suppress both encryption and MAC, if you have the separate key and cert both in PEM:
openssl pkcs12 -export -keypbe NONE -certpbe NONE -nomac -in cert.pem -inkey key.pem -out out.p12
# if you need to add chain cert(s), see the man page or ask further
otherwise since you have an existing pfx:
openssl pkcs12 -in old.pfx -nodes | openssl pkcs12 -export -keypbe NONE -certpbe NONE -nomac -out new.p12
But my previous answer without
-nomac apparently worked for at least some people because the reader can ignore a MAC that it can't verify without the password, but can't use the encrypted bags without the password.