I don't think you can use Let's Encrypt to do SSL for a subdomain without also hosting the root domain as well. I have a few like you mentioned too, and I just have blank, 1-page websites at the root level so that Let's Encrypt can query the root domain when it needs to verify the SSL info correctly.