SSL certs are installed by default. If you want to replace them with your own certs you have to make them with openssl but there is no point. If you don't want self-signed certs you have letsencrypt. To use tls simply use https port instead of http. You can restrict tls only and exclude sslv3 in nginx.conf but not all players support tls.