Make sure you have setup and secured your server first.
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d some domain.com
Accept the option to rewrite all calls to https.
sudo systemctl reload nginx
Check the status of auto renew:
sudo systemctl status certbot.timer
Dry run a renewal:
sudo certbot renew --dry-run