Ubiquiti removed keytool (and java) from recent releases of Unifi OS. This moves from keytool to openssl's native pkcs12.
Tested on Unifi Dream Machine which runs Unifi OS and a built-in Unifi controller.
Also added backup of existing files prior to change in case anything goes wrong, and update system configuration with compatible ciphers.
it is related to this bug report: opnsense/plugins#3525
FreeBSD's sed doesn't have the -z option, so empty certificates are delivered to vault when running the script on FreeBSD.