Почему не удается подключиться к серверу с самоподписанным доверенным сертификатом?

Question

[serhiops]

Вводил следующие команды:
openssl genpkey -algorithm RSA -out localhost.key

openssl req -new -x509 -key localhost.key -out localhost.crt -days 365

sudo cp localhost.crt /etc/pki/ca-trust/source/anchors/

sudo update-ca-trust

openssl verify -CAfile /etc/pki/tls/certs/ca-bundle.crt localhost.crt

(пишет - localhost.crt: OK)
причем curl работает
curl https://localhost:8000/

код сервера:

'use strict';

const path = require('node:path');
const fsp = require('node:fs/promises');
const http2 = require('node:http2');

const keypath = path.join(__dirname, 'localhost.key');
const certpath = path.join(__dirname, 'localhost.crt');

const tlsOptions = async (keypath, certpath) => ({
  key: await fsp.readFile(keypath),
  cert: await fsp.readFile(certpath),
});

const main = async () => {
  const options = await tlsOptions(keypath, certpath);
  const server = http2.createSecureServer(options);
  server.on('stream', (stream) => {
    stream.respond({ ':status': 200 });
    stream.end('success');
  });
  server.listen(8000);
};

main();

клиента

'use strict';

fetch('https://localhost:8000/').then(console.log);

Система - Fedora 41, Ошибка:

node:internal/deps/undici/undici:13185
      Error.captureStackTrace(err);
            ^

TypeError: fetch failed
    at node:internal/deps/undici/undici:13185:13
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5) {
  [cause]: Error: Client network socket disconnected before secure TLS connection was established
      at TLSSocket.onConnectEnd (node:_tls_wrap:1730:19)
      at TLSSocket.emit (node:events:531:35)
      at endReadableNT (node:internal/streams/readable:1696:12)
      at process.processTicksAndRejections (node:internal/process/task_queues:82:21) {
    code: 'ECONNRESET',
    path: undefined,
    host: 'localhost',
    port: '8000',
    localAddress: null
  }
}

Node.js v20.18.0

Comments

[Valentin Barbolin]

localhost:8000

Вот это должно совпадать с CN в сертификате.

[d-stream]

Valentin Barbolin, нет

[Valentin Barbolin]

d-stream, ну ок.