it was even simpler than that... literally just had to C&P the sectigo/comodo SSL intermediate crt (pubkey) to the end of my web server's copy of my SSL certificate and 💥 done no more bullshit

infinity subdomains, zero bullshit