Since these use cases already require having software installed on your machine, it seems fine and safer to use a browser extension with native messaging for th

Since these use cases already require having software installed on your machine, it seems fine and safer to use a browser extension with native messaging for this: https://developer.chrome.com/extensions/nativeMessaging https://developer.chrome.com/extensions/nativeMessaging https://wiki.mozilla.org/WebExtensions/Native_Messaging https://wiki.mozilla.org/WebExtensions/Native_Messaging That bypasses the entire certificate question and lets the website know it's communicating with exactly this app and not something happening to listen on the port (and vice versa, too). ... Or, depending on what you're doing, just use a real desktop app, perhaps with an embedded browser.