diff --git a/README.md b/README.md
index 1e16702..8942275 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ wget http://commondatastorage.googleapis.com/gtv-videos-bucket/sample/BigBuckBun
 
 Use ffmpeg to create a LL-DASH playlist. This creates a segment every 2s and MP4 fragment every 10ms.
 ```
-ffmpeg -i media/source.mp4 -f dash -use_timeline 0 -r:v 24 -g:v 48 -keyint_min:v 48 -sc_threshold:v 0 -tune zerolatency -streaming 1 -ldash 1 -seg_duration 2 -frag_duration 0.01 -frag_type duration media/fragmented.mpd
+ffmpeg -i media/source.mp4 -f dash -use_timeline 0 -r:v 24 -g:v 48 -keyint_min:v 48 -sc_threshold:v 0 -tune zerolatency -streaming 1 -ldash 1 -seg_duration 2 -frag_duration 0.01 -frag_type duration media/playlist.mpd
 ```
 
 You can increase the `frag_duration` (microseconds) to slightly reduce the file size in exchange for higher latency.
@@ -72,7 +72,7 @@ The Warp server defaults to listening on UDP 4443. It supports HTTP/3 and WebTra
 
 ```
 cd server
-go run ./server
+go run main.go
 ```
 
 ## Web Player
diff --git a/cert/fingerprint b/cert/fingerprint
index 63dc5eb..ba533e6 100755
--- a/cert/fingerprint
+++ b/cert/fingerprint
@@ -1,7 +1,7 @@
 #!/bin/bash
 set -euo pipefail
 
-HOST="localhost.warp.demo"
+HOST="localhost"
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
diff --git a/cert/generate b/cert/generate
index be3222b..7ee63d5 100755
--- a/cert/generate
+++ b/cert/generate
@@ -3,17 +3,4 @@ set -euxo pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-# Generate a new RSA key/cert for local development
-HOST="localhost.warp.demo"
-
-openssl req \
-	-x509 \
-	-out "${HOST}.crt" \
-	-keyout "${HOST}.key" \
-	-newkey rsa:2048 \
-	-nodes \
-	-sha256 \
-	-subj "/CN=${HOST}" \
-	-extensions EXT \
-	-config <( \
-		printf "[dn]\nCN=${HOST}\n[req]\ndistinguished_name = dn\n[EXT]\nsubjectAltName=DNS:${HOST}\nkeyUsage=digitalSignature\nextendedKeyUsage=serverAuth")
+mkcert -cert-file localhost.crt -key-file localhost.key localhost 127.0.0.1 ::1
diff --git a/player/package.json b/player/package.json
index 05ce596..cbbdf4f 100644
--- a/player/package.json
+++ b/player/package.json
@@ -1,7 +1,7 @@
 {
   "source": "src/index.html",
   "scripts": {
-    "serve": "parcel serve --https --port 4444",
+    "serve": "parcel serve --https --host localhost --port 4444 --cert ../cert/localhost.crt --key ../cert/localhost.key",
     "build": "parcel build",
     "check": "tsc --noEmit"
   },
diff --git a/server/go.mod b/server/go.mod
index 11fe995..962370c 100644
--- a/server/go.mod
+++ b/server/go.mod
@@ -11,7 +11,6 @@ require (
 )
 
 require (
-	github.com/alta/insecure v0.0.0-20210905232608-f5263498f0b2 // indirect
 	github.com/francoispqt/gojay v1.2.13 // indirect
 	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
 	github.com/golang/mock v1.6.0 // indirect
diff --git a/server/go.sum b/server/go.sum
index 2e0dbe3..d89d1e0 100644
--- a/server/go.sum
+++ b/server/go.sum
@@ -10,8 +10,6 @@ git.apache.org/thrift.git v0.0.0-20180902110319-2566ecd5d999/go.mod h1:fPE2ZNJGy
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/abema/go-mp4 v0.7.2 h1:ugTC8gfEmjyaDKpXs3vi2QzgJbDu9B8m6UMMIpbYbGg=
 github.com/abema/go-mp4 v0.7.2/go.mod h1:vPl9t5ZK7K0x68jh12/+ECWBCXoWuIDtNgPtU2f04ws=
-github.com/alta/insecure v0.0.0-20210905232608-f5263498f0b2 h1:EywIbCj4slTFpT1rcE7g2MXFwjT5CynfVfwsERs+yuo=
-github.com/alta/insecure v0.0.0-20210905232608-f5263498f0b2/go.mod h1:r6TOiezIAprr6kv8prNJ3SRKJKOVtcpizS1jU4RZdos=
 github.com/anmitsu/go-shlex v0.0.0-20161002113705-648efa622239/go.mod h1:2FmKhYUyUczH0OGQWaF5ceTx0UBShxjsH6f8oGKYe2c=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/bradfitz/go-smtpd v0.0.0-20170404230938-deb6d6237625/go.mod h1:HYsPBTaaSFSlLx/70C2HPIMNZpVV8+vt/A+FMnYP11g=
diff --git a/server/main.go b/server/main.go
index d23a1ff..7f562e9 100644
--- a/server/main.go
+++ b/server/main.go
@@ -11,7 +11,6 @@ import (
 	"os"
 	"strings"
 
-	"github.com/alta/insecure"
 	"github.com/kixelated/invoker"
 	"github.com/kixelated/warp-demo/server/internal/warp"
 )
@@ -41,11 +40,11 @@ func main() {
 
 func run(ctx context.Context) (err error) {
 	addr := flag.String("addr", "127.0.0.1:4443", "HTTPS server address")
-	cert := flag.String("tls-cert", "", "TLS certificate file path")
-	key := flag.String("tls-key", "", "TLS certificate file path")
+	cert := flag.String("tls-cert", "../cert/localhost.crt", "TLS certificate file path")
+	key := flag.String("tls-key", "../cert/localhost.key", "TLS certificate file path")
 	logDir := flag.String("log-dir", "", "logs will be written to the provided directory")
 
-	dash := flag.String("dash", "../media/fragmented.mpd", "DASH playlist path")
+	dash := flag.String("dash", "../media/playlist.mpd", "DASH playlist path")
 
 	flag.Parse()
 
@@ -54,18 +53,9 @@ func run(ctx context.Context) (err error) {
 		return fmt.Errorf("failed to open media: %w", err)
 	}
 
-	var tlsCert tls.Certificate
-
-	if *cert != "" && *key != "" {
-		tlsCert, err = tls.LoadX509KeyPair(*cert, *key)
-		if err != nil {
-			return fmt.Errorf("failed to load TLS certificate: %w", err)
-		}
-	} else {
-		tlsCert, err = insecure.Cert()
-		if err != nil {
-			return fmt.Errorf("failed to create insecure cert: %w", err)
-		}
+	tlsCert, err := tls.LoadX509KeyPair(*cert, *key)
+	if err != nil {
+		return fmt.Errorf("failed to load TLS certificate: %w", err)
 	}
 
 	config := warp.ServerConfig{