Couldn't you bind localhost.yourdomain.com to a public IP, get a certificate, install that certificate locally, then change localhost.yourdomain.com to resolve to 127.0.0.1?