most probably vaultwarden is not able to read certificates due to permission issue. Basically you could copy certs on a place where vaultwarden is able to read them or you are going to allow vaultwarden access to the certs. Or as an alternative you use a revers proxy (the web server hosting NextCloud). This way HTTPS on vaultwarden could be disabled and no additional port would need to be open