Jury rigged something using adguard's solution, had to move that part to service.sh instead of post-fs-data otherwise it bootloops.
https://github.com/AdguardTeam/adguardcert/blob/master/module/post-fs-data.sh#L50
All this shit because people behind @husky and hundreds other applications refuse to either let you connect via HTTP or at the very least respect user-specific CA store because :ebussy: usecase is unclear.