8 years plus running no solution to Certificate could not be updated as it is already used by HTTP Based Policy

so you can replace an certificate with a new on via api. I am doing this all the time with let’s encrypt. But you need to upload a new one to the firewall and replace the current certificate with the new one in one put request. 

And you have to be mindful about the resources of Sophos in terms of prio. This situation is known to Sophos. 

Sophos is looking into addressing this situation with an upcoming release later this year. 

Sophos Support is not to place or develops fixes for missing features in the product. You can raise those concerns with your Sales engineer. 

Upload new one through api is not a problem

Example: if you have existing certificate with name  "domain-a-latest" attached to WAF rules. Sophos api doesn't allow update operations to repace the same either on web or through rest api.

Yes. That is what I am saying: you need one API call to upload the new certificate - called cert-date 

then you need a second API call to update the WAF to replace the current name with the new name. 

you cannot replace the certificate, which is in use right now. But you could do it by the approach above.

As mentioned - this will be approach in a better manner later this year by a new Sophos firewall release. 

Letsencrypt API Update Script - dynamically handles multiple certs, multiple rules, including re-grouping of policies rules - Discussions - Sophos Firewall - Sophos Community

You could try using my script on a linux machine to take care of this for you.  You just set it up with all your certificates (how they are named on your xg firewall) that you want to update, and it must have access to the certificate pem and key files locally for each certificate as well. 

Then it goes out to your firewall via the api and finds all the rules that are using that certificate name, temporarily replaces the certificate with a temp dummy certificate that it creates for this process, then uploads/updates all the certificates you set it up with ( the original ones, no need to create new ones with a different name), then goes back through all the rules and re-assigns them back to that original certificate name, and if they were a part of a firewall group, it restores the firewall group as well, and then deletes the temp certificate.

Also keep in mind, the original post was never updated as requested, to change the timeout of the curl to 120, as discovered for this user in the following post, so keep that in mind if you decide to try it.  Also, the user in that post also apparently had around 40 rules as well to update.  I have been using this script for three years without issue, to update two different certificates and multiple waf rules used by each of the two certificates.

PHP script for uploading Lets Encrypt certs is broken since 19.0 MR1 - Discussions - Sophos Firewall - Sophos Community

Letsencrypt API Update Script - dynamically handles multiple certs, multiple rules, including re-grouping of policies rules - Discussions - Sophos Firewall - Sophos Community

You could try using my script on a linux machine to take care of this for you.  You just set it up with all your certificates (how they are named on your xg firewall) that you want to update, and it must have access to the certificate pem and key files locally for each certificate as well. 

Then it goes out to your firewall via the api and finds all the rules that are using that certificate name, temporarily replaces the certificate with a temp dummy certificate that it creates for this process, then uploads/updates all the certificates you set it up with ( the original ones, no need to create new ones with a different name), then goes back through all the rules and re-assigns them back to that original certificate name, and if they were a part of a firewall group, it restores the firewall group as well, and then deletes the temp certificate.

Also keep in mind, the original post was never updated as requested, to change the timeout of the curl to 120, as discovered for this user in the following post, so keep that in mind if you decide to try it.  Also, the user in that post also apparently had around 40 rules as well to update.  I have been using this script for three years without issue, to update two different certificates and multiple waf rules used by each of the two certificates.

PHP script for uploading Lets Encrypt certs is broken since 19.0 MR1 - Discussions - Sophos Firewall - Sophos Community

Thanks for sharing, I will go through 

Do not leave out the extra part for rule-grouping in the let's encrypt script above.
By default updating firewall- or waf-rule using API will detach that rule from its rule-group!