Yes. I have it all in front of me in one terminal window.
I never did anything with /etc/hosts. What line are you referring to?
Meanwhile, I can confirm that the mydomain.net certificate (the first one in the list above) does indeed not seem to contain the forum subdomain because I just noticed that when I call forum.mydomain.net it gives me a NET::ERR_CERT_COMMON_NAME_INVALID, stating that the mydomain.net is not valid for this domain, i.e. for forum.mydomain.net.
So I had to change my NGINX configuration so that the forum.mydomain.net certificate (the third one in the list above) is used in one server block and the mydomain.net certificate in another.
I'm starting to wonder whether we are perhaps looking at a bug...
Update: see here (this is driving me insane) 