[jeroenhd]

> I should be able to without interference from my web browser

You should be. From what I can remember, both Firefox and Chrome add exceptions to user installed certificates that disable requirements such as certificate transparency logs and even things like HPKP back when that was a thing.

It's easy to make a mistake and install certificates in the system chain instead (especially on Windows), but if you pick the right certificate store I don't think you should be having any trouble. That said, it's been a while since I last dealt with Chrome, maybe things have gotten worse.

[jmwilson]

Firefox does do the right thing and seems the most usable browser for private CAs. Chrome and derivatives mostly too, except the problem mentioned about the public suffix list. Mobile clients seem the most broken. I can't get iOS to work well with my private CA packaged into a .mobileconfig, but it could be my error as well.