Replace Self-Signed SSL on Nginx

My Debian server is running Nginx and currently presents a self-signed certificate. I already own a valid Comodo SSL for the primary domain and need that certificate (plus its CA chain) installed in place of the self-signed one for every site running on the box.

What I can provide:
• Full root SSH access to the Debian server
• The issued Comodo CRT, key, and CA‐bundle files
• Current Nginx vhost files and any logs you might need

What I need from you:
• Back up existing SSL material and Nginx configs . AI generated - I dont need this line item.
• Update the server blocks so each relevant site points to the Comodo certificate and intermediate bundle
• Verify the full chain with curl and an external SSL checker to confirm there are no trust warnings
• Reload Nginx safely (with rollback if something fails) and document each step so I can repeat it on future renewals . AI generated - I dont need this line item.

I prefer a clean, manual setup—no automated tools—so please be comfortable editing Nginx configuration directly and troubleshooting any certificate path issues.