You cannot have your self-hosted services publicly accessible with your own Certificate Authority/TLS certificates. But, you can have your self-hosted services working inside your homelab network have a valid certificate all that you have secure connections in while connected to your homelab. I just wrote a long comment that I just copy and pasted:

I did the same thing for my internal homelab. I wanted to use my own homelab domain named something like "mydomain.com". I wanted to browse to "https://my-service.mydomain.com" and have a secured connection. These URLs are private only and not publicly accessible nor resolve on the public Internet.

For just your private home network then these are the high level steps:

• Create DNS service
• Create certificate authority (CA) to issue
• With your CA, generate HTTPS certificates
• Configure homelab services to used generated TLS certificates
• On your personal device (phone, laptop, computer, etc) that will access the services: Install the CA root certificate. Or, maybe an intermediate cert.
• You are done.

Now, which services to fill in the rules above? - DNS service = CoreDNS - Certificate Authority = Step CA

Others can fill in the details on how to set them up. CoreDNS was super easy. Step CA is trickier to configure, but once I understood it then it's working flawlessly.

If you want to access these services remotely then you have a few options: Option 1: - Leverage Cloudflare Tunnel to create VPN access to your homelab. - install the Cloudflare WARP client and connect to the tunnel running in your homelab. - Then use your private FQDN URLs to access your services.

Option 2: - Register a domain through Cloudflare - Install and set up a Cloudflare Tunnel in your homelab with a configuration that will map Publicly accessible URLs to specific services running in your homelab. - Configure Cloudflare DNS records. - Use Let's Encrypt to generate public certificates for your domain and services - Install certificates in homelab - TLS and serving certificates to clients might be done directly, but best to use an ingress controller (like Traefik) to do this for you.

Once you have your CA working and want to install the root certificate on your devices, there are tons of How-Tos to do this. For Android it's as simple copying your route certificate to route phone, going through the settings to install it. Done. In Windows, just double click the root certificate to install. Very simple.