You give me far too much credit. I'm a stumbling idiot. I am on OpenBSD. I am a naive user.

${doas|sudo} certbot --nginx
is discouraged by iredmail as it changes the config files of nginx. nginx official link says to use it as certbot initiated with --nginx is a plugin. If you wish to read more about it, you can read here:
https : // www . nginx . com /blog/using-free-ssltls-certificates-from-lets-encrypt-with-nginx/
(please remove spaces)
And anyways I don't read too much before I jump in. Thankfully $certbot --nginx wasn't available on my platform as there is no nginx plugin. So I was saved before I screwed my config up. After that I landed on the iredmail page which said not to use --nginx switch.

my misc.tmpl is the same as the one on github. https : // github . com /iredmail/iRedMail/blob/master/samples/nginx/templates/misc . tmpl
(remove spaces). I landed on the github page after researching some undelete tools on OpenBSD, because, duh, I had deleted the .tmpl file(s). So I had to redownload (copy paste from browser into nvim, I can't use git to save my life) them again, almost reformatted my system, but thankfully iredmail has a github page with default file in there.

My misc.tmpl is:
location ~ ^/.well-known/acme-challenge {
    rewrite ^/.well-known/acme-challenge/(.*) /$1 break;
    autoindex off;
    root /var/www/acme;
    allow all;
}
location ~ /\. { deny all; }
location = /favicon.ico { access_log off; log_not_found off; }
location = /robots.txt { access_log off; log_not_found off; }

Note: root is changed because nginx is NOT chrooted to /var/www for some reason which I will investigate later.

I read the dataswamp . org (remove spaces) link which I posted above, and after some thought of another comment by a knowledgeable guy/girl/nonbinary who posted above decided to ditch certbot altogether and use some other client. I used acme-client which comes as a part of the OS on OpenBSD.

My /etc/acme-client.conf (would be different for your system when using another ACME client like certbot) was almost default, just changed my domain to mail . mydomain . com (remove spaces). I just ran the binary after that ($acme-client -idon'tknowtheswitch directory --idon'tknowtheswitch maildotmydomaindotcom). It downloaded the *.pem file and the *.crt file. I believe it's different in iredmail docs, there's a key file and a crt file. I am not a cryptographer. I don't know the difference. But from the dataswamp website, I gathered .pem works and used it according to how it is used there.

I was worried because my crt file was inside /etc/private/mydomaindotcom . something . crt and /etc/private on my system is {chmod) 700.

Regardless, I headed over to /etc/nginx/templates/ssl.tmpl
I made the following 2 changes to default(only 2 lines anyways, rest of the file is just comments):
ssl_certificate /etc/ssl/mail . mydomain . com . fullchain . pem; (remove spaces)
ssl_certificate_key /etc/ssl/private/mail . mydomain . com . key; (remove spaces)

$restart command for nginx
make relevant cron entry
BOOM!

I may have flipped a few things here and there and maybe restarted nginx 20000 times. But for the next 1 week, I will try and help you guys if you face any .well-known-devil issues. Please do post, will monitor.