Not sure, I must say I let Caddy do all the certificate work for me. I know Caddy also creates an ACME CA signed certificate, perhaps even if you connect locally it’s using that somehow instead of the self-signed one it creates?

Regardless, not much juicy info on my end. I used Caddy and “It just works™”. Might be worth a shot for you too.