just this one simple command:
certbot certonly --agree-tos --noninteractive --email your@email.com --webroot -d my.domain.com -w /usr/share/nginx/html
output:
/etc/letsencrypt/live/my.domain.com/fullchain.pem
/etc/letsencrypt/live/my.domain.com/privkey.pem
that’s all