title: Certbot /.well-known/acme-challenge
body: <p>Should I leave the /.well-known/acme-challenge always exposed on the server?
  Here is my config for the HTTP: </p>
  
  <pre><code>server {
   listen 80;
  
   location '/.well-known/acme-challenge' {
      root        /var/www/demo;
    }
  
   location / {
            if ($scheme = http) {
              return 301 https://$server_name$request_uri;
            }
   }
  </code></pre>
  
  <p>Which basically redirects all the requests to https, except for the acme-challenge (for auto renewal). My question: Is it alright to keep location '/.well-known/acme-challenge' always exposed on port 80? Or better to comment/uncomment it manually, when need to reissue the certificate? Are there any security issues with that?</p>
  
  <p>Any advise or links to read for about the this location appreciated. Thanks!</p>