I had to generate bunch of these at work, because reasons, and I found out that you can use Caddy to do this by including `tls internal` in your Caddyfile.

The first time you install it, it will prompt you to install the root cert.