If you publish the system through reverse proxy there is no need to install any cert on Collabora system neither public nor self-signed. You just need to ensure all everything flows through the RP (Nextcloud as well!!)
take a look at this example with traefik:
some settings are not up-to-date but general idea still the same…