You would also need a publically resolvable DNS entry for your local subdomain. Let's Encrypt needs to be able to validate the hostname. If the server isn't reachable from the public web by HTTP, you can use the DNS challenge, but that would require a publically resolvable DNS entry for that hostname.
If both the server and the DNS isn't reachable/resolvable publically, you can't get a (Let's Encrypt) certificate.
Or maybe we need to apply logic not imagination.
That must refer to something already stated.
There is only one sentence that precedes ot.
That sentence only has three parts:
there is a hosted domain
the hosted domain uses an LE cert
the LE cert covers all subdomains.
So which can he add to a local server?
Not 3, that is merely informational.
Not 1, he can't add a remote host, nor that domain, to a local system
So, it must be 2.
He must be trying to add the same cert.
[which is what I had assumed all along ]