Note: make sure you set the Common Name on the SSL certs to sub.domain.com, not the wildcard *.sub.domain.com.
MAKE SURE YOU SET NGROK_DOMAIN BELOW IN BOTH SERVER AND CLIENT SECTION
NGROK_DOMAIN="my.domain.com"
git clone https://github.com/inconshreveable/ngrok.git
cd ngrok
openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -subj "/CN=$NGROK_DOMAIN" -days 1024 -out rootCA.pem
openssl genrsa -out device.key 2048
openssl req -new -key device.key -subj "/CN=$NGROK_DOMAIN" -out device.csr
openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 500
cp rootCA.pem assets/client/tls/ngrokroot.crt
# make clean
make release-server release-client
bin/ngrokd -tlsKey=device.key -tlsCrt=device.crt -domain="$NGROK_DOMAIN" -httpAddr="" -httpsAddr=""
copy bin/ngrok from server to client
NGROK_DOMAIN="my.domain.com"
echo -e "server_addr: $NGROK_DOMAIN:4443\ntrust_host_root_certs: false" > ngrok-config
./ngrok -config=ngrok-config -proto=tcp 22