Upon my recent "renewal" (replaced with new) TLS(/"SSL") certs for
[*.]balug.org, for the cert covering the web stuff, I also added:
*.staging.balug.org (*.balug.org itself also covers the bare
staging.balug.org).
Haven't added any [*.]staging.balug.org stuff to DNS, etc - at least yet,
other than that temporarily added for obtaining the cert itself.
And no rush to do so (time, priorities, ...).
Rationale(?):
I think [*.]staging.balug.org may be more logical/appropriate for
most of what [*.]new.balug.org gets used for these days (well, years now).
Might want to, at some point, phase out [*.]new.balug.org.
Once-upon-a-time www.new.balug.org was intended to and used as
the "go forward" of what www.balug.org itself would generally
become - and they were on separate hosts. Well, for many years now,
www.new.balug.org is on same host as [www.]balug.org,
and www.new.balug.org is typically and mostly (if not entirely)
used as essentially staging/preview of what www.balug.org will become,
typically updating content on www.new.balug.org (and checking/revising it)
before making those same content changes to www.balug.org