The config that you propose does not require to switch nginx off for letsencrypt refreshs, correct? Posted at Nginx Forum: https://forum.nginx.org/read.php?2,279794,279810#msg-279810