Paid CA-signed SSL certificate issue

[TheDreadPirate]

Check if the root CA they use is in your phone and TV's trust store. If not, you can try adding their root CA.

FYI, Let's Encrypt does wildcard certs if your DNS provider has a plugin for certbot. My DNS provider is Cloudflare, which has a certbot plugin, and I use wild card certs provided by LE.