diff --git a/certs/generate.sh b/certs/generate.sh
new file mode 100755
index 000000000..c519f6989
--- /dev/null
+++ b/certs/generate.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Regenerates the self-signed certificate the TLS profiles use.
+#
+# The subjectAltName matters: a certificate with only a CN is not valid to
+# anything that follows RFC 9525, which dropped CN fallback entirely, and some
+# server libraries parse the extension while loading and fail outright when it
+# is missing rather than at verification time. Every TLS profile connects to
+# localhost, so that plus the loopback addresses is what has to be covered.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+openssl req -x509 -newkey rsa:2048 -nodes \
+    -keyout server.key -out server.crt \
+    -days 3650 -subj "/CN=localhost" \
+    -addext "subjectAltName=DNS:localhost,DNS:*.localhost,IP:127.0.0.1,IP:0.0.0.0,IP:::1" \
+    -addext "keyUsage=critical,digitalSignature,keyEncipherment" \
+    -addext "extendedKeyUsage=serverAuth"
+
+chmod 644 server.crt server.key
+openssl x509 -in server.crt -noout -subject -ext subjectAltName -dates
diff --git a/certs/server.crt b/certs/server.crt
index d01b26bfb..16be20e0d 100644
--- a/certs/server.crt
+++ b/certs/server.crt
@@ -1,19 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDCTCCAfGgAwIBAgIUbEz52reYuYYb26TfVwBpyW3YACUwDQYJKoZIhvcNAQEL
-BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDMwNzEzNTYwNFoXDTM2MDMw
-NDEzNTYwNFowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
+MIIDcTCCAlmgAwIBAgIUNbyFd8r04QXc3yRecFjSqlJd2JkwDQYJKoZIhvcNAQEL
+BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTI2MDgyMjE3NTYxMVoXDTM2MDgx
+OTE3NTYxMVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
 AAOCAQ8AMIIBCgKCAQEAtJGyejZirwk/Yh5v0VwTY7YLBn+zLmHTcmkZeSiSwIUb
 P6y8vRigFoQHKSrqaS9WB49EXpuxwFTzxY0zPDjg/boJEVaPp+ct1YxS7DY93zQo
 0CSZCG/PYsw2SeXpBE93/UCajDJp3vHZXPi2tuT/zL/+dy8Si/r+ln9W8YiNINJm
 0Y2AnHgSoFDAt6sZY4B6R/FsHY3oeYlKIxIJIHZvwFpY4o1/Mr1Q8ZbfsGONEFGk
 Fsp/xB9FVFFNlM5mf3rNoRHfXZb6QykHMW2P9nXEx2cnG57xLaHhZAEzrilQ6/6G
-sI3ypxTaQCQinyz/l6yeG+uBbe4slXPHty6ue1RYeQIDAQABo1MwUTAdBgNVHQ4E
-FgQU+unU067fqVnaWvCOXgh2TIF55TUwHwYDVR0jBBgwFoAU+unU067fqVnaWvCO
-Xgh2TIF55TUwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAalzP
-zEpDH1858MTdbLf21D08DsW2BxXiZ2KsFVhE+UW4+utfGdi4s3qXbu2C4H4A4us7
-rmUYAXLZW9uZumV5yy/CfXbw3E9vy/kKztH6qNVaMfmEZNa4aNcCKziwef+/3x7e
-zI6o5pyw3ffhw9c8QIqD7ULBKLHdBKvE+NaTAzQNKWJoDDPd1HdeLkIzz4nm0xPR
-Zc8xAhIfOlniYzZ+y3NpCd7kOhfpYwMQY8mjP7cLYIQsoS2gD9reYxs2dvp/T8Y+
-skU1doO8r4ryU/wR60XXQs4ihykA8z/QUxqCgm8q4YPl8sKHUKjN9+fc0QRQCbKR
-g6nb97XFdZV9IZqtqQ==
+sI3ypxTaQCQinyz/l6yeG+uBbe4slXPHty6ue1RYeQIDAQABo4G6MIG3MB0GA1Ud
+DgQWBBT66dTTrt+pWdpa8I5eCHZMgXnlNTAfBgNVHSMEGDAWgBT66dTTrt+pWdpa
+8I5eCHZMgXnlNTAPBgNVHRMBAf8EBTADAQH/MD8GA1UdEQQ4MDaCCWxvY2FsaG9z
+dIILKi5sb2NhbGhvc3SHBH8AAAGHBAAAAACHEAAAAAAAAAAAAAAAAAAAAAEwDgYD
+VR0PAQH/BAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMBMA0GCSqGSIb3DQEBCwUA
+A4IBAQBS/+X7IblIBZD9GlG84qs24rUCptqcgER0mMEtYNuyqGsnjg0nIRGz0+wG
+Aw89cWe8uNOt7Xj6mUMufyzlAUJm+yNsHyDd1PY2iX9yQ92FBBQMRwMa819IGjJH
+2kLOXzOe16gzQtYFmqOq1j01wwreop9OwR7kf96/PgWujHFr1KuXMXnjFpf8t6Rg
+4HDCcCNhZ05aBB0UfaZnig5mQr+ZWFoCiNDK8MB6Iig6ugNUxO73AezIiNSKt4x0
+vMhn1uGkC7CqIly2Djyx4IB5lD2EfGYt+zUmiuhZJwoMf9CWlS4DuE44qyBzae/U
+qrKHULMoZOMrpG2YSiiCW4lYslEu
 -----END CERTIFICATE-----