Certbot wildcard certificate invalid for base domain

Yes, that's correct. *.tentacom.net does not include tentacom.net.