ky0

server {
        listen 80;
        server_name _;

        location /.well-known/acme-challenge {
                root /var/www/letsencrypt;
        }

        location / {
        return 301 https://$server_name$request_uri;
        }
}

[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate in certificate chain

If the wildcard character is the only character of the left-most
label in the presented identifier, the client SHOULD NOT compare
against anything but the left-most label of the reference
identifier (e.g., *.example.com would match foo.example.com but
not bar.foo.example.com or example.com).