for the mesh setup a pain point is self signed certificates. a user needs to trust the self signed cert on both SPR and the mesh by clicking thru for a temporary exception, then the setup works smoothly.
one fix is to encourage lets-encrypt/acme setups. we probably need a plugin to streamline self provisioning these