Thanks for the HowTo and Wiki entry @danb35 - very helpful.
I had a minor glitch with OnlyOffice / Nginx not being able to verify the cert CA internally, so I added the ‘–fullchain’ option. Pointing nginx conf to /etc/pki/tls/certs/fullchain.pem instead of the cert.pem resolved that issue.