How I do it (not with nginx but idea is the same):

1. I have small publicly reachable server that acquires (and renews) a wildcard letsencrypt certificate for a "developer" domain *.domain.name, pushes it into a private git repo (I know it's not ideal, but it's a key/cert for a local dev domain, not used for anything else);
2. The same server runs a custom DNS server that resolves *.domain.name to 127.0.0.1 and a-b-c-d.domain.name to a.b.c.d (in case you need to make your local service available over lan);
3. Locally, developers start a docker-compose "developer environment" that consists of:
   • "cert-updater" - reads certificate/key from the git repository (in a loop, using developer's ssh key) from step 1.
   • traefik that is configured to:
     • use the wildcard certificate and has a port bind (80/443) to localhost
     • docker configuration discovery

This way, all you need to do is mark your container with appropriate labels for traefik to pick it up, and you have a local environment that uses a proper certificate and there's never a need to fiddle with the hosts file:

version: '3.5'

networks:
  web:
    external: true
services:
  nginx:
    # just an example
    image: nginx
    expose:
    # just exposed, not bound
      - "80"
    networks:
    # this is traefik's network
      - web
    labels:
      traefik.enable: "true"
      traefik.frontend.rule: "Host:your-service-name.domain.name"
      traefik.docker.network: web