Thanks Jeremy, that makes more sense.

It runs now but it's only writing to /etc/ssl/private/cert.pem meaning that only the domain (and subs) on the last line of confconsole.domains.txt is getting a certificate.

It's not writing any of the extra domains to directories e.g. /etc/ssl/private/example.com/

/var/lib/dehydrated/certs/ contains directories for each domain but nothing in /etc/ssl/private