> there should be an easy way for users to permanently mark self-signed certificates from a local address as secure. I'm not sure I agree that that's where ux

> there should be an easy way for users to permanently mark self-signed certificates from a local address as secure. I'm not sure I agree that that's where ux need improvement. Microsoft already have a pretty "easy" solution for pushing locally trusted ca certs, but only in an "enterprise" environment. Most/all Linux distros will allow pushing to /etc/ssl/certs/ca-certificates (via eg /usr/local/share/ca-certificates and update-ca-certificates). But that doesn't help as long as browsers work hard to be "special", and manage their own trust. Being able to mark some nets as trusted/local might help - both with :::1 and with vpns.