What's wrong with Lets Encrypt and DNS challenge?
Then you get a globally recognised cert.
sudo apt-get -yy install --no-install-recommends certbot
mkdir -p le
certbot --work-dir ./le --logs-dir le --config-dir le -d localhost.mydomain.com --manual --preferred-challenges dns certonly
Adding reverse proxies for different local services becomes a piece of cake, but mkcert allows you to use `localhost` directly if needed. Personally I never have and like not having to make any changes to the trust store.