nginx config snippet to allow acme validation for TLS certificate

local-acme.conf

## Only permit acme-challenge requests that match the ACME spec,
##  return 403 for everything else
## RFC8555 specifies a base64url token (no "=")
##  with at least 128 bits of entropy (ie 22 chars minimum)
## root matches the "webroot" directory used in the certbot configuration

location ~ "^/.well-known/acme-challenge/([A-Za-z0-9_-]{22,})$" {
  default_type "text/plain";
  root /var/www/acme/;
}

location /.well-known/acme-challenge/ {
  return 403;
}