Guide Automatically Update the Pure-FTPd FTPS Certificate in aaPanel

Code:
#!/usr/bin/python3
"""Deploy an already-renewed aaPanel certificate to Pure-FTPd without exposing its key."""
import argparse,fcntl,hashlib,os,ssl,subprocess,tempfile
from pathlib import Path
parser=argparse.ArgumentParser();parser.add_argument('--dry-run',action='store_true');args=parser.parse_args()
if os.geteuid()!=0: raise SystemExit('Root required')
lock=open('/run/af-ftps-certificate-sync.lock','w');fcntl.flock(lock,fcntl.LOCK_EX|fcntl.LOCK_NB)
source=Path('/www/server/panel/vhost/cert/mail.adminslab.com');target=Path('/etc/ssl/private/pure-ftpd.pem')
cert=source/'fullchain.pem';key=source/'privkey.pem'
for p in [cert,key,target]:
 if not p.is_file() or p.is_symlink():raise SystemExit('Expected regular certificate file missing')
subprocess.run(['openssl','x509','-in',str(cert),'-noout','-checkend','604800'],check=True,stdout=subprocess.DEVNULL)
subprocess.run(['openssl','verify','-CApath','/etc/ssl/certs','-verify_hostname','mail.adminslab.com','-untrusted',str(cert),str(cert)],check=True,stdout=subprocess.DEVNULL)
bundle=cert.read_bytes().rstrip()+bytes([10])+key.read_bytes().rstrip()+bytes([10])
fd,name=tempfile.mkstemp(prefix='.af-ftps-',dir=str(target.parent));tmp=Path(name)
try:
 os.fchmod(fd,0o600)
 with os.fdopen(fd,'wb') as out:out.write(bundle);out.flush();os.fsync(out.fileno())
 context=ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER);context.load_cert_chain(str(tmp))
 old=target.read_bytes()
 if old==bundle:print('FTPS certificate already synchronized; no restart');raise SystemExit(0)
 if args.dry_run:print('DRY RUN PASS: chain, hostname, expiry and matching key validated; update required');raise SystemExit(0)
 sessions=subprocess.check_output(['ss','-Hnt','state','established','sport','=',':21'],text=True)
 if sessions.strip():raise SystemExit('Active FTP control session: deferred until next run')
 backup=Path('/root/af-hosting-batch-20261012/ftps-renewal-20261013');backup.mkdir(mode=0o700,parents=True,exist_ok=True)
 previous=backup/'previous-bundle.pem';previous.write_bytes(old);previous.chmod(0o600)
 os.replace(tmp,target);os.chmod(target,0o600)
 try:
  subprocess.run(['systemctl','restart','pure-ftpd.service'],check=True)
 except Exception:
  target.write_bytes(old);target.chmod(0o600);subprocess.run(['systemctl','restart','pure-ftpd.service'],check=False);raise
 print('FTPS certificate deployed; Pure-FTPd restarted')
finally:
 if tmp.exists():tmp.unlink()