From the console of Sophos XG.

This is how I have setup automatic certificate renewal on my linux Webserver. I’m using Cloudflare as a DNS provider and are using their API Tokens to verify ownership of my domain, when requesting a certificate from Let’s Encrypt