Use Caddy, mkcert and dnsmasq to expose your development server over HTTPS

https-during-dev.macos.sh

brew install caddy mkcert nss dnsmasq

mkcert -install

mkcert '*.app.test' '*.cdn.test'

# rename the certs and move them under /usr/local/etc/caddy/certs

cat <<EOF > /usr/local/etc/caddy/Caddyfile
*.app.test:443, *.cdn.test:443 {
  tls /usr/local/etc/caddy/certs/dev.pem /usr/local/etc/caddy/certs/dev-key.pem
  gzip
  proxy / localhost:3000 {
    transparent
  }
}
EOF

cat <<EOF >> /usr/local/etc/dnsmasq.conf
port=53
address=/.test/127.0.0.1
EOF

sudo echo "nameserver 127.0.0.1" > /etc/resolver/test

sudo brew services start dnsmasq

scutil --dns
# dnsmasq setup is successful if you see an entry for test domain like this:
# resolver #8
#   domain   : test
#   nameserver[0] : 127.0.0.1
#   flags    : Request A records, Request AAAA records
#   reach    : 0x00030002 (Reachable,Local Address,Directly Reachable Address)

sudo caddy -conf /usr/local/etc/caddy/Caddyfile
# optional: configure launchd to have caddy run on startup

Here is an updated version of Caddyfile for caddy 2 that works for me

*.app.test:80 {
    redir https://{host}{uri} permanent
}

*.app.test:443 {
    tls /usr/local/etc/caddy/certs/dev.pem /usr/local/etc/caddy/certs/dev-key.pem
    reverse_proxy localhost:3000
}

Another example for those who need to keep Host header

*.app.test:80 {
    redir https://{host}{uri} permanent
}

*.app.test:443 {
    tls /usr/local/etc/caddy/certs/dev.pem /usr/local/etc/caddy/certs/dev-key.pem
    reverse_proxy localhost:3000 {
        header_up Host {upstream_hostport}
    }
}