Redirect HTTP to HTTPS, but allow .well-known for refreshing Lets Encrypt certificate

web.config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
              	<rule name="Allow LetsEncrypt" patternSyntax="Wildcard" stopProcessing="true">
          	    <match url=".well-known/*" />
          	    <action type="None" />
		</rule>
                <rule name="Redirect to https" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>