HTTP API - Custom Domain (Regional) - incorrect SSL cert?

Currently facing this issue. Unclear about nature:

1. API Gateway, Custom Domain * - a 4th-level domain name

2. API Gateway, HTTP API, Invoke URL ** - mapped to custom domain above

Both ** and ** appear to be sending the same certificate down the wire (judging from issuance date). This is the valid cert for **, but it is invalid for **.