Ubuntu - trouble securing *.mydomain.com and *.sub.mydomain.com using different certs - apache

Question

I just added a subdomain to my site and am trying to get SSL working. Previously I had SSL working on example.net and www.example.net using a cert from namespace.com.
With the subdomain, things are not quite working.
Here is what I have in DNS entries:
CNAME: www.sub.example.net is an alias of example.net
A: sub.example.net directs to IP
CNAME: www.example.net is an alias of example.net
A: example.net directs to IP
Here is my example.net conf file:
<VirtualHost *:80>
ServerName example.net
Redirect permanent / https://example.net/
</VirtualHost>
<VirtualHost *:443>
ServerName example.net
DocumentRoot "/var/www/example/public"
<Directory "/var/www/example/public">
AllowOverride all
</Directory>
SSLEngine on
SSLCertificateKeyFile /root/example.net.key
SSLCertificateFile /root/example.net.crt
SSLCertificateChainFile /root/example.net.ca-bundle
</VirtualHost>
And my sub.example conf file:
<VirtualHost *:80>
ServerName sub.example.net
ServerAlias www.sub.example.net
DocumentRoot /var/www/sub.example
Redirect permanent / https://sub.example.net/
</VirtualHost>
<VirtualHost *:443>
ServerName sub.example.net
ServerAlias www.sub.example.net
DocumentRoot /var/www/sub.example
SSLCertificateFile /etc/letsencrypt/live/sub.example.net/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.net/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
If I go to sub.example.net and www.sub.example.net then all is well.
If I go to example.net all is well.
However, when I go to www.example.net I get error about the cert only being valid for sub.example.net and *.sub.example.net.
So for some reason the www in front of example.net is having apache not look at the namespace.com wildcard cert that I have for example.net.
Now, I created the subdoamin certs via
sudo certbot certonly --manual -d *.sub.example.net -d sub.example.net --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
I have a feeling I have some weird combo of apache conf settings and DNS entries that are causing this behavior. Any idea what I did wrong?
thanks,
Brian

Answer 1

So for some reason the www in front of example.net is having apache not look at the namespace.com wildcard cert that I have for example.net.
You don't have a ServerAlias defined for www.example.net which means it will not be able to find an exact match for the domain name. In this case it uses the first of your virtual hosts in the configuration, whichever this is in your case.