Certificiating behind a router

I have read Advanced SSL - mailcow: dockerized documentation

docs.mailcow.email

Advanced SSL - mailcow: dockerized documentation

None

I am really concerned about how best to do mail server certification on a mail cow mail server that is behind a gateway on port 80

Mission: I want to remove this box

1. Inbound Port 80 is usually a 301 redirect to web traffic nginx server called gate on 443 (it redirects to itself on port 443 basically)

2. gate then sends the host traffic via a proxy_pass to a local lan vm - it looks like this:

this is gate server

server{
       listen 443 ssl;
       listen [::]:443 ssl;
       server_name domain.com;
       ssl_certificate /etc/letsencrypt/live/www.domain.com/fullchain.pem; # managed by Certbot
       ssl_certificate_key /etc/letsencrypt/live/www.domain.com/privkey.pem; # managed by Certbot
       include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
       ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
       ssl_session_cache shared:SSL:1m;
       location / {
               proxy_pass http://192.168.0.71;
               proxy_set_header Host $host;
       }
       error_page 404 /404.html;
               location = /40x.html {
       }
       error_page 500 502 503 504 /50x.html;
               location = /50x.html {
       }
  }
  server {
    listen 80;
    server_name domain.com;
    return 301 https://domain.com$request_uri;
     if ($host = domain.com) {
         return 301 https://$host$request_uri;
     } # managed by Certbot
 
     if ($host = www.domain.com) {
         return 301 https://$host$request_uri;
     } # managed by Certbot
    return 404; # managed by Certbot
 }

As you can see the actual internal traffic is port 80 to 192.168.0.71 but it is gate that hosts the ssl certificate and 192.168.0.71 has no idea about it - note this is for WEB traffic. I need to do “whatever mailcow wants” to allow this to validate and allow outlook to validate the certificate properly

this is 192.168.0.71

 server {
       listen 80;
       root /var/www/html;
       index index.php index.html index.htm;
       server_name domain.com;
       location / {
           try_files $uri $uri/ =404;
       }
       location ~ \.php$ {
           include snippets/fastcgi-php.conf;
           fastcgi_pass unix:/var/run/php/php8.1-fpm.sock;
       }
  }

Question: How do I get rid of that outlook popup box given that I cannot really alter this gateway servers’ role and responsibility

NB: If I need to buy and import a long-life certificate I am prepared to do this