Self-signed certificate not working on docker nginx container

I can't get SSL certificate to work on my local setup. Everything starts ok, but the browsers are reporting "connection not secure". I've added cert to MacOs keychain and selected "always trust". I have dnsmasq in place for all .test domain to resolve to my local setup but I've also tried adding domain to /etc/hosts. Nothing works.

This is my nginx dockerfile

FROM nginx:latest

COPY ./default.conf /etc/nginx/conf.d/default.conf

RUN apt-get update && \
    apt-get install -y openssl && \
    mkdir /etc/nginx/ssl && \
    openssl dhparam -out "/etc/nginx/ssl/dh.pem" 2048 && \
    openssl req -x509 -newkey rsa:2048 -keyout "/etc/nginx/ssl/key.pem" -out "/etc/nginx/ssl/cert.pem" -days 365 -nodes \
        -subj "/C=HR/ST=Zagreb/L=Zagreb/O=XOO/OU=IT Department/CN=domain.test"

This is the main part of default.conf

server {
    listen 80 default_server;
    root /var/www/html;
    index index.html index.php;

    listen 443 ssl;
    server_name default_server;
    ssl_certificate /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_dhparam /etc/nginx/ssl/dh.pem;

    charset utf-8;

    # only this domain
    add_header Strict-Transport-Security "max-age=31536000";
    # apply also on subdomains
    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains";
    # protocols
    ssl_protocols TLSv1.2 TLSv1.3;

    # ciphers
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # SSL stapling
    ssl_stapling on;
    ssl_stapling_verify on;

And finally this is a part of my docker-compose.yml

version: '1'
services:
    nginx:
        build: ./docker/nginx/
        ports:
            - 80:80
            - 443:443
        links:
            - php
        volumes_from:
            - app
        networks:
            - default