I have resolved this issue after making an update to writer, and changing the sub_policy to "Admins" instead of writers

after making above change, i was able to make certificate update.

once the admin certificates were updated, I made the change again to make sub_policy to "Writers"

Not sure if this is the right way, but I am unblocked for now.