I'm new to DA and I had this exact same problem a few days ago. The solution is to configure a wildcard Let's Encrypt certificate for the root domain. There are instructions for how to do this in the DA docs but for some reason I can't find it again for you, sorry, it's there somewhere.