Scripting certificate management

So there are three ways in which you can do this: tmsh, GUI and iControl. The easiest to script and automate is iControl with something like Ansible. I'll leave you to research how to do that.

If you want to use tmsh then upload to the /var/tmp directory and use

tmsh load sys file ...

. The way this works is that each file has a name so you can renew an existing cert or you can create a new one and then modify the Client SSL profile in which it is specified. The devices in a HA pair generally have Config Sync so you load it on one and do the sync which copies it across.