thanks @rg305, I double-checked and configtest runs fine, as does the site (both before and after installing certs)...
I'll see about using --webroot and report back!
@jvanasco yep, we're serving up a 25 year-old application... and perl is tightly intertwined with the apache processes. I may play around with the standalone approach, but I'm guessing that you're probably right that webroot is likely to be my easiest path forward.