To use Let'sEncrypt certificate with your subdomain you would need to move you DNS management to DigitalOcean.

Steps to using Let'sEncrypt:

1. Register a domain with a registrar. Update the name server on the registrar to point to DO’s name server. Check $ whois <TLD name> | grep ‘Name Server’ to make sure it’s pointing to DO DNS and not the registrar’s DNS.
2. Go to the Networking tab and make an entry for your TLD in DO DNS.
3. Create a bucket and enable CDN. Create a subdomain for xxx.<tld> using LE and assign it to the CDN url.
4. Upload some assets on the bucket. Make sure it is accessible through the Edge url first.
5. Then try accessing it through the subdomain url.
6. If it does not work it’s almost always one of two reasons 1. The DNS routing isn’t working properly. 2. The cert was previously assigned to another CDN and the TTL was too long and hasn’t expired.

You can also bring your own certificate in which case the DNS management can be elsewhere (Route 53 for example) but you do need to setup the CNAME manually. For a Space named <space> in <region>which is configured with the domain www.mydomain.xyz, you would need a CNAME www.mydomain.xyz => <space>.<region>.cdn.digitaloceanspaces.com

https://www.digitalocean.com/docs/spaces/how-to/customize-cdn-endpoint/