How to add an SSL Certificate to a non toplevel domain managed by digitalocean nameservers ?

Hi,

My scenario is as followed. I do own a toplevel domain (example.com will do as an example). This is currently managed by Amazon Route 53.

On Route53 i configured a subdomain (app.example.com) to be managed by digitalocean nameservers.

This subdomain is then routed by a digitalocean loadbalancer to two droplets. This is working fine.

Now i would love to add a SSL certificate to this setup. Ideally managed automatically by digitalocean/let’s encrypt.

But i cannot configure this subdomain to use with the SSL certificate. The frontend insists to have a toplevel domain.

Is there a way to make my setup working ? Moving the whole TLD to digitalocean is not possible at the moment.