Hi @girish, hi @nebulon. Many thanks for perfect explanation, hope to have got that. Have now configured as explained above and apex domain does now also produces perfectly valid cert signed by LE.
Many thanks also for impressingly quick response during weekend - appreciated.
