Hi fkick,
Yes, you need to do the conversion and import step at every renewal.
Here is a small script that I wrote for automating the process : https://gist.github.com/cyrilpic/4504527de3a7b08ed84e
When renewing, it asks certbox to renew the certificates, insert new certificates in the keychain, ask the server app to use the new certificates (through certupdate) and remove the old certificates from the keychain.
Use at your own risks 
(You need to sudo to use it.)
As for the reverse proxy part, updating to Server 5.1.7 solved all issues for me. Maybe try to delete the sub-domain and recreate it…