This question already has an answer here:
I have a web application that I ship to users via a setup program. It runs in Windows over IIS Express (ASP.NET) and is available under the localhost domain.
Therefore, I was thinking that I could buy a certificate for local.company.com and create a DNS record for local.company.com that points at 127.0.0.1 This means that I would have to ship this certificate with both public and private keys to everyone that downloads my app.
There are practical issues of course such as that the certificate will expire at some point, or that IIS Express will give me a hard time to access it over a domain other than localhost. But before tackling these issues, is this secure? Are there better ways to achieve this?