Possibly a rogue IoT device could spoof an ip address. But that's probably not going to happen to someone who knows what they're doing. Browsers don't know if t

Possibly a rogue IoT device could spoof an ip address. But that's probably not going to happen to someone who knows what they're doing. Browsers don't know if the network is trusted and can't assume that LAN IPs are safe. It seems to me the best options are either trusting a self-signed cert (on every computer that needs access) or pay for a domain name and use letsencrypt to get a cert. I do think it's unfortunate that you now need to pay money just to do things like this on your own network, but I don't see a better way. It's either paying for a domain name or needing to explicitly trust the device.