modify SITE var and run

export SITE=yoursite.com
openssl req \
    -newkey rsa:2048 \
    -x509 \
    -nodes \
    -keyout server.key \
    -new \
    -out server.crt \
    -subj /CN=$SITE \
    -reqexts SAN \
    -extensions SAN \
    -config <(cat /etc/ssl/openssl.cnf \
        <(printf "[SAN]\nsubjectAltName=DNS:$SITE\n") \
        <(printf "basicConstraints=CA:true")) \
    -sha256 \
    -days 3650

copy the certificate in your webserver or load balancer and import the server.crt locally so the browser can recognize it

certutil -d sql:$HOME/.pki/nssdb -A -n 'yoursite.com' -i server.crt -t TCP,TCP,TCP

for android (7.1.1) you can trust server.crt in Security & fingerprint > Credential storage > Install from storage