sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d example.com

Make sure you don’t forward 80 to 443. That’s is out of spec.