A wildcard certificate covers one level only

*.example.com matches www.example.com and api.example.com, but not:

• example.com itself — the apex needs its own name.
• a.b.example.com — two levels.

That is RFC 6125, not an implementation quirk.

List the apex and common names in the SAN:

certbot certonly --standalone -d example.com -d www.example.com -d '*.example.com'

Wildcards require DNS-01 validation; HTTP-01 cannot work, because the validator picks a random subdomain you cannot pre-configure.

And a leaked wildcard certificate affects every subdomain, so key handling deserves more care than a single-name certificate.