You can get the SSL certificate on the subdomain, but the interface in the client area doesn’t show Record Name and Domain correctly.
If you select the top level domain in the CNAME domain, and then add your subdomain to the record name with a dot, you should be able to add the CNAME record. So you can add the CNAME records for _acme-challenge.forum and _acme-challenge.www.forum with the destination as shown in the client area.
I’ll write a bug report to fix this issue for subdomains.