This is not an expert setup. Instructions were gathered from many other sources. These worked for me.
This will need to be run for each domain on this server. The exact names or suffixes don't matter but you must use the correct file name in the correct places. They can all be the same. Run:
sudo openssl req -x509 -newkey rsa:4096 -sha512 -days 3650 -nodes -out /etc/ssl/localcerts/NAME1.pem -keyout /etc/ssl/private/NAME2.key
and fill in prompts. The domain name must be exact.