I've completed my small php script and it seems to work well.
This is the result in case anyone needs it:
// -- CONFIG
$certname = 'lan.domain.com'; //a registered FQDN in cPanel with acme let's encrypt enabled (wildcard cert)
$pfsense_cert_id = 1; // certificate id in pfsense to overwrite. (The correct ID can be found by hovering over an icon in the cert manager or by looking in the config file.
$ftp_server = 'ftp.domain.com'; //ftps location to your domain (cpanel).
$ftp_user_name = '';
$ftp_user_pass = '';
$server_file = '/.cpanel/nvdata/letsencrypt-cpanel'; //download file used by cPanel holding every certificate (in JSON format).
// -- PROGRAM
$conn_id = ftp_ssl_connect($ftp_server);
$login_result = ftp_login($conn_id, $ftp_user_name, $ftp_user_pass);
ftp_pasv($conn_id, true);
if (!$login_result)
die("can't login");
ob_start();
$dataLoaded = ftp_get($conn_id, "php://output", $server_file, FTP_BINARY);
$data = ob_get_contents();
ob_end_clean();
ftp_close($conn_id);
if (!$dataLoaded)
die("There was a problem downloading the json data from $ftp_server");
$jsonData = json_decode($data, true);
$cert = $jsonData['certs'][$certname];
if(empty($cert))
die("Certificate with name $certname not found");
$config['cert'][$pfsense_cert_id ]['prv'] = base64_encode($cert['key']);
$config['cert'][$pfsense_cert_id ]['crt'] = base64_encode($cert['cert']);
write_config();
exec('/etc/rc.restart_webgui');
//echo 'Certificate:', PHP_EOL, $cert['cert'], PHP_EOL;
//echo 'Key:', PHP_EOL, $cert['key'], PHP_EOL;
echo 'New certificate for ', $certname, ' is valid untill ', gmdate('r',$cert['cert_expiry']), PHP_EOL;
exit;
I've uploaded the file (named sslupdate) to the /etc/phpshellsessions directory in pfsense and I added the following cron job (through the cron package):
0 0 1 1/3 * : /usr/local/sbin/pfSsh.php playback sslupdate
