https://support.apple.com/en-us/HT210176
TLS server certificates must present the DNS name of the server in the Subject Alternative Name extension of the certificate. DNS names in the CommonName of a certificate are no longer trusted.
ah…. we should set ‘altNames’ as ‘localhost’ to allow localhost self-certificate.