The way I setup the domain name was to buy a domain from Namecheap for use for "private" and LAN use. Then I assigned my server to a subdomain of that. Then I setup my VPS that I have at Linode to also host that subdomain too and to mint a LetsEncrypt cert for it and keep the cert up to date. Then periodically I have my local server fetch the cert from my VPS.

There may be other ways. Maybe using port forwarding and dynamic DNS would have worked. Maybe I could have shelled out money and purchased a domain signing cert from say Digicert. I use to use my own CA and add it to my devices. Linux and maybe Windows too allows that but not Android, so that is why I purchased a domain and went through the drama minting a real cert. Also could have added my server as a subdomain of one I already had, but wanted my "private" stuff on a different domain then my public server for a little more privacy and long term flexibility. Also did not want to use port forwarding and dynamic DNS for security reasons though I think could have.