Thanks; after my post I played with it a bit more and came to pretty much the same conclusions. Rather than using Let's Encrypt for this, I'm using a local CA (https://smallstep.com/blog/build-a-tiny-ca-with-raspberry-pi-yubikey/), one benefit of wh...
I came here looking for an automated way to update the AP's cert; your script looks like it would do the trick--thanks for the work on that. It leaves me with a couple of questions, though:The workflow expected by the Unleashed firmware, at least, s...