Fix Apache's configuration for version 2.4.8 and above.  See
https://community.letsencrypt.org/t/untrusted-on-mobile-newbe/7903

This method uses Subjective Alternative Names (SANs) to get one
certificate for all the subdomains that Sovereign employs, whether or
not the user configured their site with the roles.

Avoid using the Include directive.  Move most of the SSL configuration
to the global configuration and leave enabling the SSL engine to each
virtual host that wants to use it.