Wildcards can only work in Virtualmin if Virtualmin is managing DNS (whether that's locally or in a cloud service like Route 53 or via Cloudmin Services), since it has to update the TXT record to match what LE expects.
If you aren't managing your DNS with VIrtualmin, you'll either need to not use wildcards (which I think is generally a good practice anyway...wildcards have some security implications, and are just more annoying to deal with) or manage them using certbot directly, assuming certbot can work with your DNS provider (it has plugins for stuff like Route 53 and several other APIs).