In iOS Provisioning Portal / App IDs / Configure /
Go through the wizard to generate the new certificate aps_production_identity.cer. Save and double click on this file to import it into your KeyChain.

Export the certificates and keys

Launch Keychain Assistant and open the “Apple Development Push Services”. You’ll see your old certificate and the new one you just downloaded.

There will be a certificate and the private key.

Right click and export the certificate “Apple Development Push Services” > Export “Apple Development Push Services …″ as apns-prod-cert.p12.
Right click and export the private key as apns-prod-key.p12.

For both exports, you do not have to specify a password.

Convert to the PEM file

openssl pkcs12 -clcerts -nokeys -out apns-prod-cert.pem -in apns-prod-cert.p12

openssl pkcs12 -nocerts -out apns-prod-key.pem -in apns-prod-key.p12
Enter a password

Remove the password with this:
openssl rsa -in apns-prod-key.pem -out apns-prod-key-noenc.pem

Merge the files
cat apns-prod-cert.pem apns-prod-key-noenc.pem > apns-prod.pem