So … I have made a new Lets Encrypt / sslforfree.com certificate. It has wildcard support and also has the root domain on the ssl cert. However, VistaPanel seems to be rejecting the cert with the following error code:
The certificate uploaded is NOT for the domain name [domain redacted (my doing)].
I know that it is for my domain name! And a wildcard for my subdomains. This is not urgent as I have CloudFlare but want to change it from Full to Full (Strict).