openssl req -x509: create a self-signed certificate

openssl req -x509 creates a self-signed certificate directly, without a separate CSR step. Add -newkey to generate the key in the same command, -nodes to leave the key unencrypted, and -addext subjectAltName=... because browsers and most TLS clients match the host name against SAN, not CN.

One command

openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout key.pem -out cert.pem -days 365 \
  -subj "/CN=localhost" \
  -addext "subjectAltName=DNS:localhost,IP:127.0.0.1" 2>/dev/null
openssl x509 -in cert.pem -noout -subject -ext subjectAltName
ls key.pem cert.pem

subject=CN=localhost
X509v3 Subject Alternative Name:
    DNS:localhost, IP Address:127.0.0.1
cert.pem
key.pem

Options explained

Trust it locally

A self-signed certificate is its own issuer, so clients reject it until you trust it explicitly: curl --cacert cert.pem https://localhost:8443/, or import it into the OS or browser trust store. For anything beyond local development, create a private CA and sign leaf certificates with it.