IP2017 SSL

In our organization we get cert's in the form .pfx file with password through a portal and these certificates are assigned based on host names we provide. They don't provide certs with wild card char like *.qa.ebay.com. Now, In our production we have 30 windows boxes and 1 siebel gtwy clustered on solaris. Please answer these questions.

1. How can we import .pfx file with password to a keystore .jks and trustore ?? Googled the solutions but none worked.

2. It has 2 top level certs 1 . root and 2, Intermediate. Do we need to import root and intermediate certs to the keystore??

3. In productions requesting certs for 32 servers and managing them very tiresome and chance of human errors.