If you create a cert for both the apex and the www version, you’ll have both covered. :smiley As you stated, the cert does not include your apex domain… thus the error.
Your redirects should be:
http://example.com→https://example.comhttp://www.example.com→https://www.example.com.- Then redirect
https://example.com→https://www.example.com(your stated preferred domain).
Then no matter whether someone types in the apex domain or the www version, they’ll land on your https://www.example.com without any errors. Best practice is to include both the apex and the www on your cert. Just make sure your amended/new cert is the one being served by your server, and not the old one.