Every root CA certificate is self-signed; the difference between a trusted root and a "self-signed certificate" error is only whether the verifier has it in its store. A self-signed server certificate provides encryption against passive eavesdropping but no authentication unless clients pin or install it, which is why browsers show NET::ERR_CERT_AUTHORITY_INVALID and tools report self-signed certificate.
For development, a local private CA (mkcert, step-ca or a few OpenSSL commands) works better than individual self-signed leaf certificates: you install one root and issue proper certificates with SANs for each host. Never disable verification in code (verify=False, rejectUnauthorized: false, InsecureSkipVerify) to make one work.
A useful command: openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout key.pem -out cert.pem -days 30 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1".