You don't need valid production certificates, just valid certificates for that domain name, signed by a CA you trust. The nuance is that you can use a local CA

You don't need valid production certificates, just valid certificates for that domain name, signed by a CA you trust. The nuance is that you can use a local CA to get a valid certificate, rather than using a production one (which you don't want to have on your computer - I mean the private part of it of course)