Which RouterOS version are you running. Do you plan to stay on that version for a very long time?
Because from version 7.22, enable-ssl-certificate has been deprecated and no longer works, replaced by add-acme. If you do intend to upgrade your device soon, then it might be better to upgrade to the latest stable (7.22.1) and write your script with add-acme in mind.
If you don't upgrade and write the script with enable-ssl-certificate now, the script will break with future upgrades and will require adjustments then.
You can see this post from me for an example using add-acme:
You can set some parameters at the top to false if you don't need to upgrade User Manager or API-SSL. Set exportCertPath to the empty string "" if you don't need to save the certificate as a file.
Also, the script enables and disable an IPv6 firewall rule (selected based on the comment) that allows access to TCP port 80 from outside. If you don't need that, comment out the lines starting with /ipv6 firewall filter. Or if you use a rule for the IPv4 firewall, then adjust those lines to start with /ip firewall filter.
If you intend to stay on the versions <= 7.21.x for a very long time, then you'll need a version that uses enable-ssl-certificates