[Sophos XG] Apache DEAD due to SSL certificate error

I recent lost access to my Sophos XG firewall's Web GUI, device is online and accessible via SSH, service and traffic are normal.

Attempt to access via HTTPS port 4444 using browser result unable to connect (no HTTP error), telnet to port confirmed it is not opened.

Suspecting issue with the firewall's web gui service, I have inspected the logs and services status using SSH.

SFVH_SO01_SFOS 21.0.0 GA-Build169 HA-Primary# service -S | grep -iE 'tomcat|apache'
tomcat               RUNNING
apache               STOPPED

SFVH_SO01_SFOS 21.0.0 GA-Build169 HA-Primary# tail /log/error_log.log
AH00526: Syntax error on line 38 of /_conf/httpd/conf/ssl.conf:
SSLCertificateFile: file '/conf/certificate/LE_SophosXG_VPN_Portal.pem' does not exist or is empty

SFVH_SO01_SFOS 21.0.0 GA-Build169 HA-Primary# tail /log/apache.log
[Wed Feb 19 02:15:47.440359 2025] [core:warn] [pid 24780:tid 140132118783808] AH00111: Config variable ${SSLCertificateKeyFileWithPath} is not defined
AH00526: Syntax error on line 11 of /_conf/httpd/conf/ssl.conf:
Port must be specified

cat /_conf/httpd/conf/ssl.conf
...Line 11...
Listen ${webconsole_https_port}
<VirtualHost _default_:${webconsole_https_port}>
    SSLProtocol -all +TLSv1.2
...Line 39...
    SSLCertificateKeyFile "${SSLCertificateKeyFileWithPath}"

I suspect the issue was due to I have been using an automated script to renew and upload Let's Encrypt certificate to Sophos XG using API, and somehow this process gone wrong, the renew cert was not uploaded but still deleting the original cert. That'y on my fault 

However, this surprised me that the API did not reject this operation to delete an active cert, and the Apache service would just stopped completely and not able to restart. (Maybe with option to fallback to machine default cert?)

Here I would like to seek fellow's advise on how to get the WebGUI running again?

Many thanks 

In future, since I have recently upgraded to latest firmware with native Lets Encrypt support, I will try to use that instead, seems more robust than using scripts+API...