Your question is very broad, but I'll try to answer it.

1. You really need to read on what TLS/SSL is and how it works **before** you continue. You can find a bunch of questions in [security.stackexchnge.com](https://security.stackexchange.com/) that ask about this and many of them even link to RFCs where you can read the full detailed explanations of how it all works

2. To configure nginx to work with TLS/SSL certificate you can use https://www.digitalocean.com/community/tools/nginx to generate the template. Just follow the guide and it should create a relatively secured vhost. If you would like to enhance the security even further - you can follow [cipherli.st](https://cipherli.st/)'s guide. They update it relatively often so the proposed settings are usually up-to-date.

3. What makes a certificate "valid" or "invalid"? It's the `Certificate Authority`. It is possible to create a private CA certificate and use it to sign a `Certificate Signing Request` (or `CSR`). The `CSR` can then be signed by the `CA` and returned to whoever needs it (in this case the Nginx server). There are multiple tutorials for this available online and you can use `easy-rsa` to do the heavy lifting. However, the down side of doing it this way is that you need to go over all machines in the network and install the `CA` in browsers and all necessary keystores. Otherwise those machine will treat the site's certificates as "untrusted" because it will be coming from an unknown `Certificate Authority`. In some cases you can also create a [`Certificate Bundle`](https://www.ssls.com/knowledgebase/how-to-install-an-ssl-certificate-on-a-nginx-server/) for nginx.

  [![CA][1]][1]

4. If you had an ingress available you could have used `LetsEncrypt` to automatically issue certificates and skip complicating your setup by having `CA` and issuing certificates on your own.


Note: Image has been borrowed from ssl.com.

  [1]: https://i.sstatic.net/egvLW.png