mkcert may work fine if you're the only person using those network resources on a single machine, ever. Otherwise you've just traded yourself a trust management

mkcert may work fine if you're the only person using those network resources on a single machine, ever. Otherwise you've just traded yourself a trust management problem: Now you need to secure the key of that CA and distribute the CA certificate to all devices that should be trusting it. This may or may not be trivial. The fundamental problem is that this CA that you generated gets basically the same trust level as a public CA, but it's just sitting there on your machine. An attacker could use it to generate certificates for almost every site and your devices would trust them. That's probably ok if only your machine trusts that CA since if the attacker rooted your box to the point that they gained access to that CA key, all is lost anyways. In a network with other devices - maybe even not under your direct control - that tradeoff looks substantially different.