Yes, sometimes it is a pain to get certificates applied correctly. Especially if you have any other subdomains within the parent domain. It took me awhile to sort it out the first time I got hosting. Even the directions do not make any sense... Fortunately now a lot of hosts have set up utilities that help make it easier. :)
I like those certificates they hand out on the Gemini network. Easy to get and you can date them to be good for ten years if you like... :)
I understand the value of them and why they are so danged hard on occasion, but I still lament having to be exposed to them. Dang it.