Force https vs. .well-known URLs

[mgutt]

I'm not absolutely sure, but I could swear that .well-known URLs were accessed by Let's Encrypt in the past through HTTP Port 80. Now I found several blocked requests through my firewall on .well-known URLs because they happen on HTTPS Port 443, because Let's Encrypt is redirected to HTTPS by Nginx Proxy Manager. I found this issue, because I do not allow requests from the USA to HTTPS Port 443 as I don't need them on my web applications. But requests from USA on Port 80 were allowed all the time to allow Let's Encrypt to update the certs, but since one of the latest Nginx Proxy Manager versions those happen on Port 443.

Am I mistaken or is this a "bug" of a recent version?