Wildcard subdomains with ssl via load balancer

As per my last comment I achieved what I wanted via NGINX Ingress controller, Cert-manager and the DO load balancer.

There is an app in DO marketplace for NGINX ingress controller.

Then used Cert manager and set up an initial test as per this article: https://www.digitalocean.com/community/tutorials/how-to-set-up-an-nginx-ingress-with-cert-manager-on-digitalocean-kubernetes#step-4-—-installing-and-configuring-cert-manager

For wild cart you need to use dns01, documentation on the cert-manager site: https://cert-manager.io/docs/configuration/acme/ - config details for lets encrypt

https://cert-manager.io/docs/configuration/acme/dns01/digitalocean/ - config for DO dns01 integration. Couple of points which were not clear to me from the above are that you need to create a secret and that your api key within the secret needs to be base64 encoded. I have created a pull request to update the documentation but in case you need it before then this is an example secret:

apiVersion: v1
kind: Secret
metadata:
  name: digitalocean-dns
  namespace: cert-manager
data:
  # insert your DO access token here
  access-token: "base64 encoded access-token here"

Also, http01 confirmations can take a while so dont worry.