Yes that true , it made it a lot easier with certificate and applying the  certs for multiple objects.
 
Ken Felix
 

sounds cool....can I get a copy of what you have so far?

 
1: upload the  new cert and then change the useage to the new cert 
 
2: delete the old certificate
 

Here is the github-repo for the current version,  it's still a bit early but it does work.  The --help feature should give you all the parameters required.  I'm trying to write it to have a config file as well so that you don't need to write the whole command every time, the beginning framework is there for this in the script but is not fully tested yet so I suggest using the cli commands.  Also this works with either password or API-Key authentication.  Let me know if things aren't working for you.
https://github.com/absmith82/fortitools

I agree that would be ideal, however, that isn't currently the case, and as far as I can tell fortios doesn't allow you to access the python shell/ecosystem so in the meantime we have to work with the tools they allow us to.

If anyone is still looking or in need for the Letsencrypt solution for fortigate here is a working process ( was testing it for the past few weeks )
 
A linux VM ( CentOS 7 or 8 ) for the certbot installation and the scripts downloaded from here ( https://github.com/gdoornenbal/dehydrated-certificate-installers ) not my repository, just sharing some great work.
 
also if you have a hosting that is usping Cpanel, you can download this plugin so you don't need to add/remove TXT entry every time you need to issue or renew a certificate ( https://github.com/badjware/certbot-dns-cpanel )
 
there are also plugins for cloudflare ( https://github.com/certbot/certbot/tree/master/certbot-dns-cloudflare )
 
as a side note, you can split the shell script in 2 parts, one for the HTTP acces the other for the VPN, if you do so, you will need to edit this part of the script:
 
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -noout -enddate | cut -d = -f 2 ]
 
into this
 
set livecertdate [exec echo | openssl s_client -showcerts -connect $host:$sslport 2>/dev/null | openssl x509 -enddate -nooout -in cert.pem | cut -d = -f 2 ]
 
when everything is ready, just setup the cronjob for the renews and you're done.
 
as a bonus and extra precaution you can install the cockpit package for web access to the VM and a 2FA via google authentificator whick you can setup for both SSH and cockpit access.
 
if someone needs help or a better clarification, just drop me a PM