It's simple, your cert points to *.domain.tld, domain.tld doesn't have a subdomain, <anything>.domain.tld does. You should expand it to include both domain.tld and *.domain.tld.
Oof, I'm not sure if I would do that. Since "" stands for all sub domains.