So attempting to create a certificate for a subdomain "virtual server" results in failure by default due to Virtualmin attempting to prepend www. to a subdomain. So I use the "manual" domain entry field to just have the subdomain in question.
I get this when attempting to do that: Requesting a certificate for sub.example.com from Let's Encrypt .. .. request failed : Expected full certificate file /letsencrypt/live/sub.example.com-0004/fullchain.pem was not found
The result is LetsEncrypt is unusable for the subdomain from within Virtualmin.