Run the following.

sudo apt-get update
sudo apt-get install certbot
sudo apt-get install python3-certbot-nginx

If you get stuck in apt update any how then just run

sudo apt-add-repository -r ppa:certbot/certbot
sudo apt update
sudo apt-get update

ref

Enable ssl

If you have pointed the domain to ec2 IP then enable the ssl by:

certbot --expand --nginx --no-redirect --non-interactive --agree-tos --register-unsafely-without-email -d YOUR-DOMAIN.com

(Subdomain is also allowed)

For subdomain add record like this below:

• Record type: A
• Name: api.YOUR-DOMAIN.com (for main domain leave @ as it is default)
• Value: Your ec2 public IP