Modify your server clause to allow the subdirectory .well-known to be served from a local directory, eg:

server {
    listen 80;
    server_name sub.domain.com www.sub.domain.com;
    […]
    location /.well-known {
            alias /var/www/sub.domain.com/.well-known;
    }
 
    location / {
        # proxy commands go here
        […]
    }
}

• certbot installation

• https://serverfault.com/questions/768509/lets-encrypt-with-an-nginx-reverse-proxy