Wildcard certificates for ZTNA

ZTNA need a Wildcard Certificate. 

LE only support Wildcard with the DNS approach. https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 So a firewall alone cannot do this kind of renewal. You need a DNS Provider with an API Interface. 

I did this kind of renewal process with DNS by Route53 in AWS with Factory:  [HowTo] Lets Encrypt Renewal Process with Factory  

ZTNA need a Wildcard Certificate. 

LE only support Wildcard with the DNS approach. https://community.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578 So a firewall alone cannot do this kind of renewal. You need a DNS Provider with an API Interface. 

I did this kind of renewal process with DNS by Route53 in AWS with Factory:  [HowTo] Lets Encrypt Renewal Process with Factory  

That covers the renewall, I am already doing the renewall of LE certs locally but then how do you update them automatically in Sophos Central for ZTNA? or that part must to be manually done every 3 months?

Can I upload it in SOphos XG to use it in the waf?

From a ZTNA perspective, you must edit the gateway and upload the new certs after the expiry period. We are also working on a direct Let's Encrypt integration with ZTNA. I do not have an ETA yet for it, but it is a part of the short-term roadmap

Will this direct integration include Cloudflare API for DNS challenge validation?

We would be using the DNS-01 CNAME mechanism for the challenge. The user would need to create a CNAME record for the acme-challenge to point to our alias domain and subsequently, we would solve the challenge. 

https://letsencrypt.org/2019/10/09/onboarding-your-customers-with-lets-encrypt-and-acme.html

Will this work as well with sophos xg? Like updating the cert in the fw managed by sophos central?

Or the plan for sophos XG is having it's own service to do that?

As of now, this implementation is restricted to the ZTNA gateway traffic only. It would work with the integrated ZTNA gateway on the firewall. But, for generic firewall implementation, I would defer it to the firewall PMs.