https://self-signed.badssl.com/

I see that the auto-generating part was removed, but I think the static in-repo certificate should be regenerated as per: "we'll just track the expiration and regenerate in-tree when needed" from #390 (comment)_