hosting: add self-signed CA