openssl req -new -newkey rsa:2048 -nodes -out ca.csr -keyout ca.key -sha256  -subj "/C=JP/ST=Tokyo/L=Shibuya-ku/O=Example, Inc./OU=IT/CN=example.com CA"

openssl x509 -signkey ca.key -days 7300 -req -in ca.csr -out ca.arm -sha256

openssl req -new -newkey rsa:2048 -nodes -out example.com.csr -keyout example.com.key -sha256 -subj "/C=JP/ST=Tokyo/L=Shibuya-ku/O=Example, Inc./OU=IT/CN=example.com"

openssl x509 -req -days 7300 -in example.com.csr -CA ca.arm -CAkey ca.key -out example.com.crt -set_serial 01 -sha256

/etc/nginx/conf.d/XXX.conf

server {
    listen 443 ssl;

    .....

    ssl on;
    ssl_certificate /etc/nginx/ssl/example.com.crt;
    ssl_certificate_key /etc/nginx/ssl/example.com.key;
    ssl_session_timeout 5m;
    ssl_ciphers 'AES128+EECDH:AES128+EDH:!aNULL';
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    .....
}

• IBM Knowledge Center - Creating a private certificate authority
• IBM Knowledge Center - Using an existing certificate authority