I figured it out with the help of DigiCert support and three different utility programs (ugh).

In case anyone else comes across this:
1. Make sure you install the certificate on the same computer that generated the Certificate Signing Request file (CSR)
2. Install the certificate
3. Export it as a PFX (may need to use a special utility, like Digicert's)
4. Use a combination of OpenSSL and the PVK transform utilities to create the SPC and PVK files. (https://ca.godaddy.com/help/converti...g-windows-6034)

What a mess. I'm glad this is only every 3 years.