Which cert uses block cert update?

Hello all,

Are FW rules the only place you can use a cert that will block that cert from being updated?

I'm working on some cert management automation and need a list of possible blockers that should be checked. So far I've been testing by assigning an LE cert to places I know about (SSL VPN, Chomebook SSO, SMTP TLS, etc) and then trying to update that cert. So far, so good. But, with all the nooks and crannies in XG, I know I'm missing something.

Thanks,

Gary