Turns out Let's Encrypt is only able to issue certificates for true top level domains registered with IANA, so I can't use LE.
Then, from Unable to get local issuer certificate: company firewall - #2 by mcmessina
I see 'resolve the errors by using the "Ignore TLS certificate errors" setting in the Synchronization -> Nextcloud -> Show Advanced Settings window which sets a global variable of sorts.'
Pressing 'Check synchronisation configuration' now shows 'Success! Synchronisation configuration appears to be correct' with Joplin Server as well, so I pressed Re-upload local data to sync target.
Then I see
Completed: 17/01/2025 20:19 (30s)
Last error: Error: Error 413 Payload Too Large: 413 Request Entity Too Large
413 Request Entity Too Large
nginx/1.22.1
So I inserted client_max_body_size 40M; into nginx.conf, pressed Re-upload local data to sync target again, and now it's creating remote items.
Fingers crossed and thanks for all the help.