You should generate your own certificates before going to production.
Depending on the go version used, the notary-server
certificate may have to be marked for both EKUs clientAuth
(for connection as a gRPC client) and serverAuth
(for serving TLS as a server).