Hi,

I have a very similar situation, except that my staging site (using staging subdomain DNS) is a new droplet from scratch, as opposed to a snapshot from existing droplet.

When I set up the Let's Encrypt SSL via Load Balancer, the traffic to my new site is certified but the certificate on the original/old site (master domain) is no longer active. Visitors get a page saying traffic is not secured.

It seems the certificate is interfering across the entire domain although I configure it for the subdomain only.

I'm using Ubuntu 16.04 and had a similar problem, although I believe that it had nothing to do with the cert. When creating a droplet from a snapshot, the default .conf configuration file still points to the root domain, not the staging domain (doesn't matter that DNS is setup properly). In my situation, I had to add a Step 4 to your Steps 1-3:

Step 4:
i. mycomputer\$ `ssh root@mynewstagingip_address
ii. root@staging\#cd /etc/apache2/sites-available
iii. root@staging:/etc/apache2/sites-available\#nano 000-default.conf`
iv. Re-write two lines in the "000-default.conf" file:

From:

  <VirtualHost *:80>
          ServerName my_domain.com
          Redirect permanent / https://my_domain.com
  </VirtualHost>

To:

  <VirtualHost *:80>
          ServerName staging.my_domain.com
          Redirect permanent / https://staging.my_domain.com
  </VirtualHost>

Save the 000-default.conf file (Control+o, Enter, Control+x)

v. root@staging:/etc/apache2/sites-available# systemctl restart apache2
vi. root@staging:/etc/apache2/sites-available# exit
vii. my_computer\$ sudo subl /etc/hosts
viii. Add IP address and staging domain here:

xxx.0.0.x   localhost
xxx.xxx.xxx.xxx broadcasthost
my_staging_IP staging.my_domain.com
::1             localhost

ix. Cmd+s #to save the file
x. Clear cache on your browser

Result: success...
Now when typing either my_staging_IP_address (only need steps i-vii) into my browser OR staging.my_domain.com, I'm successfully redirected to staging.my_domain.com. Note: I do have a safety warning from my browser because my particular cert does not cover subdomains...but I can ignore that.

Entire Step 4 explained:
i. SSH into your domain (I did this as root)--there is decent documentation on setting up SSH in DO
ii. Change directory to find the "000-default.conf" file #no need to separate these steps ii and iii, just writing this the long way
iii. Open "000-default.conf" file with nano text editor
iv. Change settings to point to your staging site:

• Resource: using parts of "Step 4" from this tutorial on DO v. From "Step 5" in that tutorial above, simply restart the apache2 server for changes to take effect vi. exit back to local machine terminal for final steps vii. open /etc/hosts with my text editor, which is Sublime in my case (from "Step 6" in that tutorial) viii. Add my IP address and staging domain just above the final line ix. save with Sublime or whatever text editor x. I needed to clear my cache, since previous attempts all redirected to my_domain.com