Hi @girish, hi @nebulon. Many thanks for perfect explanation, hope to have got that. Have now configured as explained above and apex domain does now also produces perfectly valid cert signed by LE. 👍🏼
Many thanks also for impressingly quick response during weekend - appreciated. 😊