The following renewal configurations were invalid

[Osiris]

@BPL

are you suggesting i should delete somehow the existing approved certificates for domain1, ..., domain7 and somehow create new certificates for *.domain1, ..., *.domain7 ?

I would recommend expanding the existing certificates, not deleting them and making a new one. Although in the end it comes down to the same. Although if you delete the certs, try making the wildcards and for some reason don't succeed, you've got zero certificates Always make a backup though.

@BPL

I didn’t know it was possible to get certificates for wildcarded domains?

For quite some time now.

@BPL

would it be possible somehow to use the approved certificates for the official domains in the staging boxes?

Sure, I don't see why not. It would mean using the "regular" hostnames though, not local.domain variants.

@BPL

I think at this point I’ve made clear my main goal is being able to use ssl in the staging boxes before deploying to production, so… This shouldn’t be a very rare use-case, right?

Not a very rare use case no. Sometimes people use their own CA for local developing, as it's perfectly possible to include your own root on your own systems. However, using Let's Encrypt certificates is possible too.