So, the issues were:
- webpki does not support IP addresses as DNS names in URLs,
so I hacked the HttpsConnector to always provide a fixed string
as the DNS name for server certificate validation
- the certificate requied a SAN section which was complicated to build
but eventually the solution is there in genkeys.sh
