certonly options means
certbot will only save the issued certificate to your servers disk (by default at the location
certonly, you yourself are responsible to install the certificate into your webserver.
I would suggest using the Mozilla SSL Configuration Generator to use the appropriate configuration for your webserver.
You will need to change:
You might want to choose to disable the
HSTS Enabled option on the generator, until you’re sure your HTTPS works perfectly.