Can't get https working with nginx & let's encrypt

I can’t access my sites over https. Exact error message is browser specific, for example “A connection was reset (corresponding to a TCP RST).” When I try nothing is recorded in the nginx logs for the sites I’m trying to access, so I’m not sure if the request is getting as far as nginx.

Checking the server is listening on 443, running sudo netstat -plutn shows

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      31216/nginx: master

Checking if the firewall is blocking 443, running iptables -L -n -v, the only lines mentioning 443 or 80 are:

29235 1687K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80
  253 13652 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:443

And checking from another machine if port 443 is open, running nc -zv mysite.com 443 shows Connection to mysite.com port [tcp/https] succeeded!

Probably the most basic server block I have in my nginx config file is:

server {
        listen          443 ssl http2;
        server_name     static2.mysite.com;

        #Allow access for lets encrypt challenge
        location /.well-known {
                allow all;
        }

        ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;
        include ssl.conf;


#rewrite to static1.
return 301 https://static1.mysite.com$request_uri;

}

(though this particular one doesn’t have logging, other server blocks that also don’t work, do have logging).

and ssl.conf looks like:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/ssl/certs/dhparam.pem;
ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:$
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security max-age=15768000;

And I definitely restarted nginx.

So I’m not sure what the problem is, unless it’s the actual cert files generated by lets encrypt are invalid, but I don’t know how I’d check that?