You should generate your own certificates before going to production.
Depending on the go version used, the notary-server certificate may have to be marked for both EKUs clientAuth (for connection as a gRPC client) and serverAuth (for serving TLS as a server).