Ofcourse you are aware that with incepted device you can install and remove any pem CA's to your device with acmcli command? So you can have your selfsigned CA as trusted etc.

As a hint "acmcli -lc common-ca -L" gives you list of currently installed SSL CA's.

Disclaimer: if you don't know what your doing, then don't touch acmcli command. You have been warned!!!