server {
	listen [::]:443 default_server ssl http2;
	listen 443 default_server ssl http2;
	server_name localhost;
	ssl_certificate /etc/letsencrypt/live/localhost/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/localhost/privkey.pem;
	return 200 "hello world: server 01";
}

make-cacert org.local
make-cacert-certificate localhost
docker run --detach --name nginx-https \
    --volume "${PWD}/https.conf:/etc/nginx/conf.d/default.conf" \
    --volume "${PWD}/tls-certs/service.pem:/etc/letsencrypt/live/localhost/fullchain.pem" \
    --volume "${PWD}/tls-certs/service.pem:/etc/letsencrypt/live/localhost/chain.pem" \
    --volume "${PWD}/tls-certs/service.key:/etc/letsencrypt/live/localhost/privkey.pem" \
    --publish "4443:443" \
    --workdir "/usr/share/nginx/html/" \
    nginx
curl -SsD- --cacert tls-certs/rootca.cert https://localhost:4443/
docker stop nginx-https
docker rm nginx-https