Dear friends,
I almost burned my eyes but have to call it quits. Hope you can help.
I have an nginx server setup on a raspberry box to power an rtorrent/rutorrent seedbox.

I get the /rutorrent page just fine from any local LAN client.

From my cellphone/iPad when NOT connected via WiFi but via cellular data (hence clients NOT on my local LAN) I cannot load the /rutorrent page nor the / page.

What is making me crazy is that ONCE I saw the damn page but now not anymore. Sometimes I see nothing at all, some other times despite using a http://xxx.yyy.www.zzz static IP public address the cellular browsers get a "secure connection failed" error.

FWIW sudo nginx -t succeeds while running nginx -t without root privileges quite understandably gives:
bob@rpi2b:/etc/nginx/sites-available $ nginx -t
nginx: [alert] could not open error log file: open() "/var/log/nginx/error.log" failed (13: Permission denied)
2018/08/11 18:06:47 [warn] 21893#21893: the "user" directive makes sense only if the master process runs with super-user privileges, ignored in /etc/nginx/nginx.conf:1
2018/08/11 18:06:47 [emerg] 21893#21893: SSL_CTX_use_PrivateKey_file("/etc/ssl/private/ruweb.key") failed (SSL: error:0200100D:system library:fopen:Permission denied:fopen('/etc/ssl/private/ruweb.key','r') error:20074002:BIO routines:file_ctrl:system lib error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib)
nginx: configuration file /etc/nginx/nginx.conf test failed

Here follows the related data. Thank you for any help.

default available-sites:
server {
listen 80;
root /var/www;
index index.html index.php index.htm;

#Below enter IP address or block to allow, eg LAN and/or VPN blocks
allow all;

error_page 403 = @denied;
location @denied {
return 301 https://$host$request_uri;
}

location / {
try_files $uri $uri/ =404;
}

location /rutorrent {
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
include /etc/nginx/conf.d/php;
include /etc/nginx/conf.d/cache;
}

#include /etc/nginx/sites-available/dload-loc;

location ~ /\.ht {
deny all;
}
}

server {
listen 443 ssl;

root /var/www;
index index.html index.php index.htm;

client_max_body_size 40m;

ssl_certificate /etc/ssl/ruweb.crt;
ssl_certificate_key /etc/ssl/private/ruweb.key;
ssl_session_timeout 5m;

location / {
try_files $uri $uri/ =404;
}

location /rutorrent {
client_max_body_size 40m;
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
include /etc/nginx/conf.d/php;
include /etc/nginx/conf.d/cache;
}

#include /etc/nginx/sites-available/dload-loc;

location ~ /\.ht {
deny all;
}

}