環境

AlmaLinux 8.5 x86_64
nginx バージョン 1.21.6 リリース 1.el8.ngx

前提条件

nginxが設定済みで、非SSL（http）で公開されている必要があります。
この記事の例では、hogehoge.suzu-ha.com をSSL化するので、http://hogehoge.suzu-ha.com がインターネットからアクセス可能でなければなりません。

nginxのconfファイルで、server_nameディレクティブがSSL化したいドメイン名になっているserverブロックが存在する必要があります。
この記事の例では、以下のような記載が必要です。

server {
    listen       80;
    server_name  hogehoge.suzu-ha.com;

設定手順

まずはEPELリポジトリをインストール

# dnf install epel-release

必要なパッケージをインストール

# dnf install certbot python3-certbot-nginx

certbotで証明書発行

何回も試行錯誤したものを、「順調に進んだら多分こうだろう」という推測で再構成してます。
もしかしたら表示順や文言などが異なるかもしれません。

# certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): 自分のメールアドレスを入力

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.

Please enter the domain name(s) you would like on your certificate (comma and/or
space separated) (Enter 'c' to cancel): hogehoge.suzu-ha.com
Requesting a certificate for hogehoge.suzu-ha.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/hogehoge.suzu-ha.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/hogehoge.suzu-ha.com/privkey.pem
This certificate expires on 2022-05-02.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for hogehoge.suzu-ha.com to /etc/nginx/conf.d/default.conf
Congratulations! You have successfully enabled HTTPS on https://hogehoge.suzu-ha.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -