Use Certificate Chain Composer at https://tools.keycdn.com/certificate-chain to reconstruct the chain. The certificate generated by Certificate Chain Composer should be used in URL branding command.

Formatting of the .pem file is incorrect. The .pem file should look as follows. No empty lines are allowed in the file.

-----BEGIN CERTIFICATE-----
Certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Intermediate certificate
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Root certificate
-----END CERTIFICATE-----

To decrypt the encrypted private key execute the following command.

# openssl rsa -in enc.key -out dec.key
Enter pass phrase for enc.key and hit Enter

The output file dec.key should be used when executing branding request command.

You may check if key and certificate md5 are different with "openssl x509 -noout -modulus -in CERTIFICATE.pem | openssl md5" == "openssl rsa -noout -modulus -in PRIVATEKEY.key | openssl md5"

Example:
openssl rsa -noout -modulus -in .key | openssl md5 
33dc9083fc0a8ed7d5e3409ebb734e8f
openssl x509 -noout -modulus -in .pem | openssl md5 
f7d5fe21a30a38854fe7b07a69db8a9a