Solution for SSL VPN Configuration Renewal Without Requiring User Re-Download

What do you mean, the VPN does not work with the appliance certificate? 

I'm talking about changing the certificate in this field.

Should I choose the Appliance Certificate one? If I choose this, will users need to add it manually to their computers?

Yes they will have to reload the certificate, it will break all existing VPNs, but this is a one time change, you would do and not be an yearly change. 

By the way: Sophos Connect supports a provisioning file: https://docs.sophos.com/nsg/sophos-firewall/21.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/RemoteAccessVPN/IPsecSSL/SophosConnect/RAVPNSConProvisioningFile/index.html 

Having approximately 1000 users install certificates creates a lot of problems. :) there must be another solution

Again: Using the yearly certificate creates a profile, which is usable only a year - And there is no real benefit of doing it with a public signed certificate. 

You need to switch it back to the appliance certificate, which is valid for a long time (15 years or so) and redeploy it. You could redeploy it by using the Provisionen file above. 

If needed, you can also contact your Sophos Partner for more insights. 

I understand, but it is not possible for me to distribute the device's CA private certificate (i.e. Appliance Certificate) to users' computers. Because users are customers working outside my network. Therefore, it is not possible for me to publish the certificate.

I repeat my question. When I choose this, do I need to manually add this CERTIFICATE to user computers?