I am having a bit of a problem with this myself...however, without being able to see the browser certificate details, i would say its because your host.domain.com has a "Self Signed" SSL certificate (as does mine)
My understanding is that we obviously need to use a CA registered authority Cert such as Lets Encrypt SSL ...was there a "Checkbox" for Lets Encrypt SSL cert when you performed a Hostname change? (I believe there is supposed to be a checkbox and you need to select it)
I am still trying to figure out how to do this because i have not yet found any reference tutorial on how to do it that actually works with the current version of CWP.