Paid CA-signed SSL certificate issue

[TheDreadPirate]

Not sure what else to suggest.

If the device trusted the root, but not the intermediate CA, the full chain should have bridged that trust gap.

If it doesn't trust the root nor the intermediate, and you can't manually add certs, I'm not sure you can address that without switching cert providers. Again, Let's Encrypt does do wildcard certs if your DNS provider has a certbot plugin.

However, IIRC you can add certs to Android TV devices when you put the device in developer mode.