I've set up a Nginx server on Ubuntu 16.04

I've done what I normally do (which works), except this time I have two sites, and not just one.

One site is www.domain.com, and the other is staging.domain.com

I have a redirect rule in the www.domain.com conf file, to direct non-www to www, and also to direct HTTP requests to HTTPS (on that domain).

The trouble is that if I type domain.com into a browser (with no http or https in front) I end up on a browser error page telling me the certificate is for an invalid domain. For some reason it redirects to https://domain.com, and tries to load the SSL certificate from staging.domain.com

If I put https://domain.com into a browser, it redirects to https://www.domain.com as expected.
If I put http://www.domain.com into browser, it redirects to https as expected.

Here is the conf files from each site:

For www.domain.com

fastcgi_cache_path /home/waiheke26/sites/www.domain.co.nz/public/cache levels=1:2 keys_zone=www.domain.co.nz:100m inactive=60m;
server {
    listen 80;
    listen [::]:80;
    server_name domain.co.nz www.domain.co.nz;
    return 301 https://www.domain.co.nz$request_uri;
}
server {
    listen 443;
    listen [::]:443;
    server_name domain.co.nz;
# Note: I added following ssl_certificate lines in case that was the issue. This made no difference.
       ssl_certificate /etc/letsencrypt/live/www.domain.co.nz/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/www.domain.co.nz/privkey.pem;
    return 301 https://www.domain.co.nz$request_uri;
}
server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    server_name www.domain.co.nz;
    root /home/waiheke26/sites/www.domain.co.nz/public;
    ssl_certificate /etc/letsencrypt/live/www.domain.co.nz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.domain.co.nz/privkey.pem;
    index index.php;
    access_log /home/waiheke26/sites/www.domain.co.nz/logs/access.log;
    error_log /home/waiheke26/sites/www.domain.co.nz/logs/error.log;
    include global/server/defaults.conf;
    include global/server/fastcgi-cache.conf;
    include global/server/ssl.conf;
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
    location ~ \.php$ {
        try_files $uri =404;
        include global/fastcgi-params.conf;
        fastcgi_pass   $upstream;
        fastcgi_cache_bypass $skip_cache;
        fastcgi_no_cache $skip_cache;
        fastcgi_cache www.domain.co.nz;
        fastcgi_cache_valid 60m;
    }
    rewrite ^/robots.txt$ /index.php last;
    location ~ /purge(/.*) {
        fastcgi_cache_purge www.domain.co.nz "$scheme$request_method$host$1";
    }
}

For staging.domain.com

fastcgi_cache_path /home/waiheke26/sites/staging.domain.co.nz/public/cache levels=1:2 keys_zone=staging.domain.co.nz:100m inactive=60m;
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name staging.domain.co.nz;
    root /home/waiheke26/sites/staging.domain.co.nz/public;
    ssl_certificate /etc/letsencrypt/live/staging.domain.co.nz/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/staging.domain.co.nz/privkey.pem;
    index index.php;
    access_log /home/waiheke26/sites/staging.domain.co.nz/logs/access.log;
    error_log /home/waiheke26/sites/staging.domain.co.nz/logs/error.log;
    include global/server/defaults.conf;
    include global/server/fastcgi-cache.conf;
    include global/server/ssl.conf;
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
    location ~ \.php$ {
        try_files $uri =404;
        include global/fastcgi-params.conf;
        fastcgi_pass   $upstream;
        fastcgi_cache_bypass $skip_cache;
        fastcgi_no_cache $skip_cache;
        fastcgi_cache staging.domain.co.nz;
        fastcgi_cache_valid 60m;
    }
    rewrite ^/robots.txt$ /index.php last;
    location ~ /purge(/.*) {
        fastcgi_cache_purge staging.domain.co.nz "$scheme$request_method$host$1";
    }
}

For default

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    return 444;
}

If any other config data would be useful, please let me know.