I setup the Let'S Encrypt through the control panel of Webmin/Virtualmin.
Under Virtualmin> Manage SSl Certificate I had the choice to request a certificate for "domains associated with this server" or "domains listed here"
The former listed the 2 domain names on the virtual server, and the latter listed the server's host domain name.
I chose the former thinking that the current LE certificate was covering the hostname domain.
I then requested (re-requested) the certificate.
Mistake.
Now I can access any of the virtual server domain names from any browser (great!) - but have blocked access to the hostname domain thus cannot access my control panel on the VPS.
In retrosepct, I should have added the virtual server domain names to the hostname domain when requesting the LE certificate.
How do I fix this?