Nginx config for Let's Encrypt renewal challenges

default_http.conf

server {                                                                                                                                                                                                           
  listen 80 default_server;
  listen [::]:80 default_server;

  server_name example.com *.example.com blub.example.com;

  # No redirect to HTTPS for Let's Encrypt renewal challenges
  location ~ /.well-known {
    root /var/www/html;
    allow all;
  }

  # Redirect to HTTPS for all other locations
  location / {
    #return 301 https://$server_name$request_uri;
    return 301 https://$host$request_uri;
  }
}