certbot certonly --preferred-challenges=dns --manual -d vpn.blah.com --manual-public-ip-logging-ok --logs-dir . --work-dir . --config-dir .
- remove old certs + keys on router
- copy priv key and pcert to router
/interface sstp-server server set certificate=none
then `/interface sstp-server server set certificate=realcert'
Credit to https://github.com/Disassembler0/mikrotik-scripts/blob/master/sstp-lets-encrypt/sstp-cert-upload.sh