and I'm not sure where it's configured.
Workaround: To add new subdomains, I've been manually editing /srv/web/ssl/letsencrypt.list, then:
# docker exec -ti web script -q -c "/bin/bash" /dev/null
root@web/# /usr/sbin/nginx -s reload
root@web/# /letsencrypt/dockergen.sh
root@web/# cd /ssl
root@web/ssl# ln -s letsencrypt/live/subdomain.cloyne.org/fullchain.pem subdomain.cloyne.org.crt
root@web/ssl# ln -s letsencrypt/live/subdomain.cloyne.org/privkey.pem subdomain.cloyne.org.key
(Approximately)