You need to get a cert from Let’s Encrypt (using certbot), then look up directions for configuring nginx to use the cert files generated by certbot.