[zurn]

TLS doesn't require CA. Browsers just decided they do, so they're rejecting any such https connections (anon DH and anon ECDH connections).