On this page, https://www.wapt.fr/en/doc-1.5/Installation/security/install_ssl_certificate...

it says to chown the crt and key-files to the group nginx, well, on Debian Stretch, there is no such group, but rather www-data.

The nginx config file /etc/nginx/nginx.conf says user www-data;

Maybe this is different for other Linux distributions.