Your question is very broad, but I'll try to answer it.

1. You really need to read on what TLS/SSL is and how it works before you continue. You can find a bunch of questions in security.stackexchnge.com that ask about this and many of them even link to RFCs where you can read the full detailed explanations of how it all works

2. To configure nginx to work with TLS/SSL certificate you can use https://www.digitalocean.com/community/tools/nginx to generate the template. Just follow the guide and it should create a relatively secured vhost. If you would like to enhance the security even further - you can follow cipherli.st's guide. They update it relatively often so the proposed settings are usually up-to-date.

3. What makes a certificate "valid" or "invalid"? It's the Certificate Authority. It is possible to create a private CA certificate and use it to sign a Certificate Signing Request (or CSR). The CSR can then be signed by the CA and returned to whoever needs it (in this case the Nginx server). There are multiple tutorials for this available online and you can use easy-rsa to do the heavy lifting. However, the down side of doing it this way is that you need to go over all machines in the network and install the CA in browsers and all necessary keystores. Otherwise those machine will treat the site's certificates as "untrusted" because it will be coming from an unknown Certificate Authority. In some cases you can also create a Certificate Bundle for nginx.

4. If you had an ingress available you could have used LetsEncrypt to automatically issue certificates and skip complicating your setup by having CA and issuing certificates on your own.

Note: Image has been borrowed from ssl.com.

Your question is very broad, but I'll try to answer it.

1. You really need to read on what TLS/SSL is and how it works before you continue. You can find a bunch of questions in security.stackexchange.com that ask about this and many of them even link to RFCs where you can read the full detailed explanations of how it all works.

2. To configure nginx to work with TLS/SSL certificate you can use https://www.digitalocean.com/community/tools/nginx to generate the template. Just follow the guide and it should create a relatively secured vhost. If you would like to enhance the security even further - you can follow cipherli.st's guide. They update it relatively often so the proposed settings are usually up-to-date.

3. What makes a certificate "valid" or "invalid"? It's the Certificate Authority. It is possible to create a private CA certificate and use it to sign a Certificate Signing Request (or CSR). The CSR can then be signed by the CA and returned to whoever needs it (in this case the Nginx server). There are multiple tutorials for this available online and you can use easy-rsa to do the heavy lifting. However, the down side of doing it this way is that you need to go over all machines in the network and install the CA in browsers and all necessary keystores. Otherwise those machine will treat the site's certificates as "untrusted" because it will be coming from an unknown Certificate Authority. In some cases you can also create a Certificate Bundle for nginx.

4. If you had an ingress available you could have used LetsEncrypt to automatically issue certificates and skip complicating your setup by having CA and issuing certificates on your own.

Note: Image has been borrowed from ssl.com.