@eso @p @Kirino I usually use my own self-signed certs (importing them on Android is pain in the ass as badly behaved apps like Husky keep ignoring them unless you're rooted and put them straight into /system) and a .local zone on router's dnsmasq.