trying to see exactly which problem I have — openssl s_client -debug -connect localhost:9093 -tls1_2 -showcerts. Tension: I generated my truststore, ca and keystore different way but they alway lead to the same problem. Outcome: When you sign your certificate, include a Subject Alternative Name (SAN) record.

4256f013-5b98-49f3-9f9a-a43515914b89