:local DomainName "your-domain" #доменное имя вашего домена
:local certNameSSL "le_ssl" #Желаемое имя сертификата,но оно должно совпадать для задачи в sheduler
:local PASS "12345678" #пароль, не менее восьми символов

:log info "LE renewal"

/ip service 
enable [find where name="www"]
/ip firewall filter
enable [find where comment="HTTP"]

:do {
   /certificate remove [find where common-name=$DomainName]
} on-error={ :log info "LE old cert not exist" }

:do {
   /certificate
   :log info "LE waiting renewal..."
   enable-ssl-certificate dns-name=$DomainName
   :delay 30s
   :log info "LE renewal complete"
   :local certName [get [find where common-name=$DomainName] name]
   :log info "LE new cert name=$certName"
   set  $certName name=$certNameSSL
   :do {
      /file remove $certNameSSL
   } on-error={ :log info "LE $certNameSSL file not exist" }
   export-certificate numbers= $certNameSSL export-passphrase=$PASS  type=pkcs12 file-name=$certNameSSL
   /system/scheduler set $certNameSSL interval=10w


   #TODO: Сделать отправку нового сертификата в службы
   #      или сделать привязку к SSTP, hotspot и т.д...


} on-error={ 
   :log error "LE fail to get new cert" 
   :do {
      /certificate import file-name=$certNameSSL name=$certNameSSL passphrase=$PASS
   } on-error={ :log error "LE can't import old cert $certNameSSL"  }
   /system/scheduler set $certNameSSL interval=2d
}

/ip service 
disable [find where name="www"]
/ip firewall filter
disable [find where comment="HTTP"]

/system/script
add name="lets_encrypt" policy=read,write,policy

/ip firewall filter
add action=accept chain=input comment=HTTP dst-port=80 protocol=tcp

/system/scheduler
add name=le_ssl interval=10w start-time=01:23:45 on-event="/system script run lets_encrypt" policy=read,write,policy