When using legacy security, it's possible for the server to lazily generate a self-signed certificate on first use for a specified host name. I've created a proposal for adding similar functionality when Elytron is in use:

https://github.com/wildfly/wildfly-proposals/pull/332

Any feedback is welcome.

Thanks,
Farah