I set up DrayDDns and installed certificate. In Lan redirection set myisp.drayddns.com to to local 2862AC router. On local network I can make a secure connection to myrouter.dynddns.com. Management from the internet is disabled.
SSL Vpn connection work ok. Its the only open port on the wan side.

Go me thinking could I do similar for the access points. The only reference to certificates on the AP is under radius.
Can create a Root certificate, but not a self signed cert.

Now my limited understanding of self signed certificates is
Create a Root CA
Create a certificate signed by the root CA import these into windows 10 trusted certificates.

I cant find any info on how to do this for AP,
Is it possible? any info on where to start would be appreciated

Oops just noticed I put http should have HTTPS