@eris choose whichever you prefer, if you already have a .well-known, just use that
if you don't, faster to just use the ngnix plugin for certbot https://www.nginx.com/blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/