Thanks for investigation Steven Tobin!
About the certificate - what is required to make it cover the root domain? Is even possible to do some changes to it?