openssl pkcs12 -export -in MYSITE.crt -inkey [I]MYSITE.key -name eap -out [I]MYSITE.p12[/I][/I]
[I][I]it is important that the "name" parameter is "eap"![/I][/I]
[*][I][I]use an easy-to-remember password, you'll need it a few steps later (then it will be irrelevant)[/I][/I]

I just successfully used an LE cert on my controller. Here is what I did.

First I created a script that stops the controller, builds a new keystore and then starts the server. You can get the script here:

https://pastebin.com/raw/U1zYQGHe

Then I generate the new cert using acme.sh (https://acme.sh) and reference my script (reloadEAP.sh) similar to this:

./acme.sh --issue --dns dns_cf -d eap.example.com --reloadcmd /root/.acme.sh/reloadEAP.sh

If you want acme.sh to setup a cron job to automatically renew the cert and automatically inject it into the EAP controller just run this command:

./acme.sh --install

Obviously you will need to alter the paths in the script and find the right command line options for generating a cert with acme.sh for your environment. You don't have to use acme.sh, my relaodEAP.sh script could be adapted to work with any cert you want. I'm mostly using the steps I found in this thread only I added the password to the command lines so it can be run without user interaction.

Hope this helps someone.

@R1D2 

That works too if you want to renew by hand.