That’s a fair point. However, on the practical side, it’s sad that I would have to root my gf’s phone to let her access the services we host.

I ended up using a DynDNS and Caddy for managing my cert.

I don’t know about iOS, but Android had support for this in the past. Now the support is partial. It’s no longer possible to install system-level certificates. Or at least they made it extremely inconvenient.

Let’s be extra safe. New cert per every request

not all phones support manually adding certs