How do I setup and generate certs for SurrealDB?

[oblivisheee]

Hello, seeking for help! I'm trying to setup TLS for Surreal server but don't really understand how to connect to it with wss://.
When I'm trying to connect I get:

~/Doc/Projects/knotos-backend master !5 ?1 ❯ surreal sql --conn wss://localhost:8000 --user root --pass root   14:32:56
2025-05-11T11:33:02.634875Z ERROR surreal::cli: There was a problem with the database: There was an error processing a remote WS request: IO error: invalid peer certificate: UnknownIssuer

I don't get any warns in logs.
Here is script I use to generate certs:

#!/usr/bin/env python3
import os
import subprocess
from stat import S_IRUSR, S_IWUSR

def run(cmd):
    print(f"\033[1;32mEXECUTING: {cmd}\033[0m")
    subprocess.run(cmd, shell=True, check=True, text=True)

def secure_permissions(path):
    os.chmod(path, S_IRUSR | S_IWUSR)  # 600 permissions
    print(f"Set secure permissions for {path}")

def generate_main_dir():
    os.makedirs('certs', exist_ok=True)

def generate_dirs_surrealdb():
    os.makedirs('certs/surrealdb', exist_ok=True)

def generate_surrealdb_cert_and_key():
    # Generate CA private key
    run('openssl genrsa -out certs/surrealdb/ca.key 4096')
    secure_permissions('certs/surrealdb/ca.key')

    # Generate CA certificate
    run('openssl req -new -x509 -sha256 -key certs/surrealdb/ca.key -out certs/surrealdb/ca.pem -days 3650 -subj "/CN=SurrealDB CA"')
    secure_permissions('certs/surrealdb/ca.pem')

    # Generate server private key
    run('openssl genrsa -out certs/surrealdb/server.key 4096')
    secure_permissions('certs/surrealdb/server.key')

    # Generate server certificate signing request (CSR)
    run('openssl req -new -key certs/surrealdb/server.key -out certs/surrealdb/server.csr -subj "/CN=localhost"')

    # Sign server certificate with CA
    run('openssl x509 -req -in certs/surrealdb/server.csr -CA certs/surrealdb/ca.pem -CAkey certs/surrealdb/ca.key -CAcreateserial -out certs/surrealdb/server.pem -days 3650 -sha256')
    secure_permissions('certs/surrealdb/server.pem')
if __name__ == "__main__":
    generate_main_dir()
    generate_dirs_surrealdb()
    generate_surrealdb_cert_and_key()
    print("\n\033[1;32mSUCCESS! Certificates generated in certs/surrealdb/\033[0m")