It turns out it’s a 7 day wait according to @Ed_S here !
Rebuild didn’t work.
I re-ran wizard setup to add www to get new cert. That seemed to work but I had to follow @pfaffman suggestion to disable connection check bypassing the 443 inaccessible error.
Now it is failing to load the cert, from logs:
...PEM_read_bio_X509_AUX() failed (SSL: error:0480006C:PEM routines::no start line:Expecting: TRUSTED CERTIFICATE)
This may be related to 443/80 closed port issue, which is another problem I see is a common problem.
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 72556/docker-proxy
tcp6 0 0 :::443 :::* LISTEN 72564/docker-proxy
Scan the ports via an external checker they come up closed 