Voici un exemple

server {
    if ($host = toto.domaine.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


        listen 80;
        listen [::]:80;

        root /home/.../public_html/toto.domaine.com;
        index index.html index.htm index.nginx-debian.html;

        server_name toto.domaine.com;

        location / {
                try_files $uri $uri/ =404;
        }


}

server {
    listen 80;

     server_name toto.domaine.com;

}

server {
    listen 443 ssl http2;

    server_name toto.domaine.com;

    root /home/actocom/public_html/toto.domaine.com;

    location / {
        try_files $uri /index.php?$args;
    }

location ~ \.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    fastcgi_index index.php;
    include fastcgi_params;
    }


    ssl_certificate /etc/letsencrypt/live/toto.domaine.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/toto.domaine.com/privkey.pem; # managed by Certbot
}

Mettre ce fichier dans /etc/nginx/sites-available nomez le toto.domaine.com par exemple

sudo ln -s /etc/nginx/sites-available/toto.domaine.com /etc/nginx/sites-enabled/

sudo systemctl restart nginx

sudo certbot certonly --authenticator standalone --pre-hook "nginx -s stop" --post-hook "nginx"