This is how the Let’s encrypt template requests the certificate:
Specifically --issue -d $$ENV_DISCOURSE_HOSTNAME meaning that it only issues a request for the hostname given to discourse. In order to get both www and non-www you need to adjust the template to issue more than one -d argument.
Something like as shown here:
(read the replies, some adjustments to the original topic are necessary but I am unable to edit it)