DO loadbalancer won't add Lets Encrypt cert for subdomain that DO is managing

I have a DO load balancer. There’s a subdomain that I want the load balancer to generate a Lets Encrypt SSL certificate for. I’ve created an NS record pointing the subdomain to DO’s name servers. Even though I can manage the subdomain via DO now the load balancer won’t create the cert. It says the domain is not managed by DO.

I contacted DO support and was told that Lets Encrypt will only create certs if the domain itself, not the subdomain, is under DO control. That’s not practical in my situation.

What have folks done in this situation? Have you created your own load balancer, e.g. with Apache httpd?

Thanks.