Default SSL Certificate being picked up - wildcard dns entry

hi there -

I have a web app that runs based on the dns address - ex: abc.blah.com but "abc" can be "def" or any number of other keywords. however the problem seems to be although its going to the correct site and doing what its meant to be doing (i.e. the php is dragging the right stuff from the database for that domain etc) on standard http. When run with HTTPS its using the default virtualmin certificate rather than the "lets encrypt" one I'm asking it to use.

to support my theory - Apache reports: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)

If I create a subdomain called test.blah.com and create a lets encrypt certificate for that - it picks up the correct certificate fine.

so I believe something is happening when the DNS record is passed and forwarded to the shared ip address. What steps am i missing?

I'm running on a test domain at the moment however the final home for this app runs on a wildcard SSL certificate on the shared ip address.