It looks like adding the let encrypt root certificate to the spa-112 lets this work.
Import of root CA certificate of certificate used is mandatory step of setup. No way to make it working without it.
But the spa-112 doesn't take https links https://letsencrypt.org/certs/trustid-x3-root.pem.txt, so putting the cert file on a http server works.
If you have no root certificate imported, then HTTPS connection is considered untrusted, so it fails. If you have root CA imported already, the HTTPS connection is possible, but unnecessary - you need not to import same CA certificate again.
In short - either you can't use https or you need not to use it.
Is there a better way to do this?
Import of root CA needs to be done once. It need not to be repeated unless phone is wiped to factory default state.
But yes, you can avoid all those issues - forget LetsEncrypt, use certificates issued by Cisco for the purpose. Required root CA is part of firmware, it needs not to be imported at all.
