2 ms·

For all local/non-public instances I just use "tls self_signed" and have Caddy generate a cert on demand.