My team’s internal portal runs on plain http on the LAN, at http://192.168.1.82:8888. I wanted its note editor to grab a screenshot of another window straight from the browser, Flameshot-style, with getDisplayMedia(). On that address the API isn’t there at all: browsers only offer screen capture in a secure context, and an http page on a LAN IP is not one.

The fix is https next to http, with a certificate signed by a small local CA that each computer trusts once. My first attempt, the usual one-line self-signed openssl req -x509, made the wrong kind of certificate: a CA certificate with no serverAuth usage, which Apple’s rules reject.