Yes, you did
keytool genkey in the file
server.jks so that file contains your private key. What you need to do is, first add your cert (chain) to the JKS, THEN convert the JKS to "PFX". The p7b by itself does not contain sufficient information.
.p7b from the CA contains the cert for your server, and may contain other "chain" or "intermediate" certs which your server cert depends on. You say this cert is from a "local CA"; is that CA itself delegated from a well-known "root" CA like Verisign? If not, if the local CA has its own root, is that root already added to the
jssecacerts file in your
JAVA_HOME/lib/security? (If you or other users on your system have been interacting with systems using this CA and it has a private root, you likely have already needed to add it to a truststore, but not necessarily the standard one.)
IF the chain the CA gave you uses a root that is either already in the Java-distributed
cacerts like Verisign or has been added to
cacerts on your specific system, run
keytool -keystore server.jks -alias serverkey -import -file whatever.p7b -trustcacerts
The response should be "Certificate reply was installed in keystore". If it says "Certificate was added to keystore" that is actually an error even though it doesn't say so.
Then convert to PKCS#12, which is the actual standard Microsoft and some other people call PFX, as one line but broken for posting:
keytool -importkeystore -srckeystore server.jks -destkeystore server.pfx
-deststoretype pkcs12 -srcalias serverkey
On the first step, if the needed root (or anchor) isn't in
cacerts (well-known or already added) but at least one CA cert is in the p7b,
keytool will display info about the "top-level" certificate and ask
Install reply anyway?; just answer "yes". If anything more complicated is wrong, give details.