@_az and @schoen , thank you.
Hooray! After I sent them _az’s instructions, Omnis figured out how to give me a CSR for both the bare and www. versions of the URL. (They didn’t tell me how they did it.) I copied that CSR into ZeroSSL’s wizard and got a Let’s Encrypt certificate. (Details of that process are in this post: Have fixed IP and CSRs, need SSLs to give to hosting service . I had to tell NoScript to allow scripts globally this time during the ZeroSSL procedure.) I sent that certificate to Omnis, and they installed it on the server for me. All the variations of the URL work now. Phew. I think I can use the same CSR when I need to renew the certificate. Mark this one SOLVED.