Nginx: redirect HTTPS site to www HTTPS, need certificate?

Yes, you need a certificate for the https:// site to redirect to https://www site. In general the easiest way is to get a certificate that covers both the www and non-www and use that in both server configurations. Let's Encrypt does this no problem.

Why does your configuration work?

I have no idea why your configuration above works, with no certificate specified. As far as I know It shouldn't.

I put your config into my Nginx instance on AWS, slightly tweaked as follows

server {
  listen              443 ssl;
  listen              [::]:443 ssl;
  server_name         example2.com;
  return              301 https://www.example2.com$request_uri;
}

server {
  listen              443 ssl;
  listen              [::]:443 ssl;
  server_name         www.example2.com;

  root /var/www/folder;
}

I added the following to my /etc/hosts

11.0.1.10 example2.com www.example2.com

When I did a wget this is what I got

wget https://www.example2.com
--2017-07-29 08:07:17--  https://www.example2.com/
Resolving www.example2.com (www.example2.com)... 11.0.1.10
Connecting to www.example2.com (www.example2.com)|11.0.1.10|:443...     connected.
Unable to establish SSL connection.

You can see that it can connect to the server, but can't establish an SSL connection. When I use curl I get a different response, but it doesn't work.

curl https://www.example2.com
curl: (35) Encountered end of file

Based on this I think there's something missing from what you've told us.

Here's how it should be

This shows how Nginx should be configured.

# Main website, https www
server {
  server_name www.example.com;
  listen 443 ssl http2; # http2 is optional
  ssl_certificate /path/to/fullchain;
  ssl_certificate_key /path/to/privkey;

  # locations etc
}

# forward https non-www to www
server {
  server_name example.com;
  listen 443 ssl;
  ssl_certificate /path/to/fullchain;
  ssl_certificate_key /path/to/privkey;

  return 301 https://www.example.com$request_uri;
}    

# Forward http to https
server {
    listen       80;
    server_name  example.com www.example.com;
    access_log  /var/log/nginx/access.log main buffer=128k flush=1m if=$log_ua;
    return       301 https://example.com$request_uri;
}