First use acme.sh to renew the certificate. Then follow

cat .../fullchain.cer .../<domain>.key >bundle...pem
curl -X PUT --data-binary @bundle...pem --unix-socket /run/<control.socket> http://localhost/certificates/bundle..
rm bundle...pem
curl -X PUT --data '{"certificate": "bundle.."}' --unix-socket /run/<control.socket> http://localhost/config/listeners/*:443/tls

No need to restart the unit service. The new certificate is configured now. Lastly to clean up the old certificate,

curl -X DELETE --unix-socket /run/<control.socket> http://localhost/certificates/<old_bundle>

To check the uploaded certificates,

curl -X GET --unix-socket /run/<control.socket> http://localhost/certificates/