Well bugger me.
I've:
- set up my own certificate authority
- created a CSR
- signed that CSR
- installed the resulting cert on a server
- configured apache2 to use it
- added my own root cert to my laptop and my Android phone
- configured Firefox on both my laptop and my phone to trust my root ce...