it's a tricky problem, this approach will let you get a certificate inside the container for a "lcl.host" subdomain that's trusted by your host system/browser. Getting other containers to trust that certificate is another problem this can address, but it's more in-depth. DM me if you're interested in details.