Upon my recent "renewal" (replaced with new) TLS(/"SSL") certs for [*.]balug.org, for the cert covering the web stuff, I also added: *.staging.balug.org (*.balug.org itself also covers the bare staging.balug.org).
Haven't added any [*.]staging.balug.org stuff to DNS, etc - at least yet, other than that temporarily added for obtaining the cert itself. And no rush to do so (time, priorities, ...).
Rationale(?): I think [*.]staging.balug.org may be more logical/appropriate for most of what [*.]new.balug.org gets used for these days (well, years now). Might want to, at some point, phase out [*.]new.balug.org. Once-upon-a-time www.new.balug.org was intended to and used as the "go forward" of what www.balug.org itself would generally become - and they were on separate hosts. Well, for many years now, www.new.balug.org is on same host as [www.]balug.org, and www.new.balug.org is typically and mostly (if not entirely) used as essentially staging/preview of what www.balug.org will become, typically updating content on www.new.balug.org (and checking/revising it) before making those same content changes to www.balug.org