v21 Let's Encrypt Cert creation and renewal fails, whan NAT Rule for HTTP/HTTPS exists

We cant fix this and UTM had the same issue. 

We are not going to disable legit NAT Rules for HTTP for customers - "just to renew the cert". 
WAF is always behind the NAT Rules, as NAT takes priorities here. 
Maybe you could generate a WAF Rule for HTTP ? 

As LE does not tell, what IPs they are using, it is impossible to perform a renewal here. 

BTW: You only need HTTP for LE - So maybe you do not need the HTTP NAT Rule (as HTTP could be considered to be "insecure" in the first place. 

 LuCar Toni In the documentation the certificate request is descibed as following:
"The Let's Encrypt CA must communicate with the firewall to validate the CSR. For this communication, the firewall temporarily creates a WAF rule. After the CA validates the CSR, the firewall deletes the rule."

For LE certificates the requesting webserver must be reachable via HTTP in the verification process.
Is it possibe, that this could be an issue if I already have a WAF rule for the LE certificate active where "Redirect HTTP" is ticked or is that temporary WAF rule forced to be "first" or "only" served?

"Only" because of this: "During the Let's Encrypt CA validation period for any CSR, the web applications protected by WAF rules will be unavailable through the firewall."

So essentially, if you have multiple WAF Rules, it does not matter. The WAF Rules are there to redirect the request to the WAF Service, which takes over the LE renewal. 

So essentially, if you have multiple WAF Rules, it does not matter. The WAF Rules are there to redirect the request to the WAF Service, which takes over the LE renewal.