Redirect everything but .well-known in NGINX (Let's Encrypt)

I want to get a certificate via the letsencrypt.sh so I have to provide a challenge on HTTP.

Already I use NGINX to forward to SSL (served on a nodejs server). Now I want to still redirect everything to SSL, but not the challenge.

Here is my config

server {
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    server_name screen.example.com;

    location /.well-known { }

    location / {
        return 301 https://$server_name$request_uri;
    }
}

Opening a challenge URL still redirects me to HTTPS.

How can I fix this?