Comment by luma

Replace self-signed certs with a self-signed CA? Now you're just moved the problem, and you'll still have challenges with modern mobile OSes.

If you're going through all the effort to instrument everything with certbot, why not just use LE and get a real cert?