People buy the .net, the common misspelling and the old company name. What to do with them is a choice between two behaviours, and only one of them is usually correct.

Alias: serves the same site at a second address

Both addresses return 200 with identical content. Two copies of every page, and search engines have to decide which is real. Almost never what you want.

Parked: redirects to the main domain

The second domain answers with a 301 and sends the visitor to the main one. The name keeps working, the traffic arrives, and there is one site.

server {
    listen 80;
    listen 443 ssl;
    server_name example.net www.example.net;
    ssl_certificate     /etc/letsencrypt/live/example.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.net/privkey.pem;
    return 301 https://example.com$request_uri;
}

$request_uri carries the path, so example.net/about lands on example.com/about rather than dumping everyone on the home page.

It still needs a certificate

A redirect from https://example.net happens AFTER the TLS handshake. Without a certificate for that name the visitor sees a security warning first, and most of them stop there. Issue one for every parked domain.

If you genuinely want an alias

Serve it, and set a canonical tag pointing at the main domain on every page, so there is no ambiguity about which is the original.

<link rel="canonical" href="https://example.com/about">

Check what you have

curl -sSI https://example.net/about | grep -E '^HTTP|^location'
Renew the parked domains. A misspelling that lapses is bought by somebody else within days, and it then points your typing customers at their site.