NICE DCV licensing public endpoint has bad TLS certificate

We're trying to evaluate NICE DCV, and it looks like it needs to talk to 'dcv-license.us-east-1.s3.amazonaws.com' for licensing. Our instances have Internet access thru a NAT GW path, so should be able to reach that public service endpoint.

However we're finding that the TLS certificate on the endpoint is invalid so the licensing connection fails. The site has a wildcard cert for '*.s3.amazonaws.com' -- but an asterisk only matches one level deep and is therefore not valid for X.Y.s3.amazonaws.com.

I know we have the option of setting up a Gateway Endpoint but I find it hard to believe a simple issue like this could be an obstacle for the public endpoint path that is supposedly supported. What am I doing wrong? Thanks.