Use certificates signed by a ca that is included in Your browser/systems trust store.
Edit: on request of I add a way to create a ca-signed certificate including nowadays necessary default extensions with some quite default openssl 1.1.1 setup without needing to edit openssl.cnf and/or setup a "proper" ca.
Create a ca key and cert:
openssl genrsa -out ca.key 2048
openssl req -x509 -new -extensions v3_ca -key ca.key -days 3652 -out ca.crt -sha256 -subj "/C=CC/ST=Some State/L=Some City/O=Some Organisation/OU=Some Org Unit/CN=Some Chosen CA Name/emailAddress=someuser@some.domain.org"
Note 1: You may want to encrypt/passwordprotect the ca.key using the -aes256 option to genrsa command, otherwise a stolen ca.key could be used to sign certificates Your browser trusting Your ca trusts blindly
Note 2: You do not need to include that much information in subject, so for example -subj "/CN=Some Chosen CA Name" would be sufficent
Add the ca certificat (ca.crt) to Your browser or systems trust-store.
Create certiciates signed by Your ca:
openssl genrsa -out some-example.key 2048
openssl req -new -key some-example.key -sha256 -subj "/C=CC/ST=Some State/L=Some City/O=Some Organisation/OU=Some Org Unit/CN=*.local/emailAddress=someuser@some.domain.org" | openssl x509 -req -CA ca.crt -CAkey ca.key -CAcreateserial -out some-example.crt -days 730 -sha256 -extfile <(echo -e 'basicConstraints=critical,CA:FALSE\nnsCertType=server\nnsComment="OpenSSL Generated Certificate for App Tests"\nsubjectKeyIdentifier=hash\nauthorityKeyIdentifier=keyid,issuer\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:*.local,DNS:local,DNS:*.testdomain,DNS:testdomain')
Note 1: You may not want/need to include the "Netscape" extensions (the line beginning with ns in generated extfile), it's a common OpenSSL default to include nsComment and also to hint setting nsCertType in config, but is not set in many certificates nowadays.
Note 2: modern client should only use the subjectAltName for subject-name verification, which means the CN in the certificates subject becomes informational and ALL names (or IPs, OIDs, ...) the certificatre shall be valid for shall go into subjectAltName. Also subjectAltName should be used even in case You want the vertificate to be valid for only a single name or address.
Note 3: You do not need to include that much information in subject, so for example -subj "/CN=Some App Test Certifciate" would be sufficent if client properly uses the SAN extension to verify subject.
This example certificate would be valid for Hostnames local, testdomain and all direct child names (i.e. app1.local, app2.local, app3.testdomain).
Of Course You can create the certificates or only for the single hostnames You want, as long as You use same ca.crt and ca.key the will all work in the browsers trusting ca.crt.
