Couldn't mkcert handle most of that process?