The mkcert script generates invalid SSL certs. The
problem is that conf/root.cnf is used for the CA,
server, and client certificates when each should use
its own config file in conf/
Simply modifying mkcert to call conf/root.cf, then
conf/client.cnf, and finally, conf/server.cfr per
openssl command block fixes the problem.