What password does OSX Server use when importing SSL certificates?
It looks like OP's problem has been solved, but for the record it's actually fairly easy to get the keys from OS X Server, as long as you have admin access to the server. I'll give you two ways to do it:


Run the Keychain Access utility on the server, select "System" from the Keychains list, then "My Certificates" from the Category list under that. Select the relevant certificate on the right side of the window, then from the File menu choose "Export Items. In the export dialog, make sure the file format is set to "Personal Information Exchange (.p12)" to export both the private key and (public) certificate. It will ask for your admin name &amp; password to get access to the keychain, then ask for a new password to encrypt the exported file with.
The certificate and associated private key are also stored (as you said) in /etc/certificates. Make sure you get both the certificate (filename ending ".cert.pem") and matching private key (".key.pem"); you might also need the cert chain (".chain.pem"), which includes your certificate and the supporting certificates that vouch for its authenticity.

The private key file will be encrypted with a randomly-generated password. No problem; in order for server services to use this key, its password is stored (in the system keychain, actually) in a retrievable form. With admin rights, you can retrieve it the same way the web server does. Use this command (replacing server.example.com with the actual domain name):

sudo /Library/Server/Web/Config/apache2/getsslpassphrase server.example.com:443 RSA


It'll require your admin password, then spit out what looks like a GUID. That's the encryption password for the .key.pem file.

(Note: in older versions of OS X Server, getsslpassphrase was in /etc/apache2/ instead of /Library/Server/Web/Config/apache2/. Adjust as needed.)