http://zzz.i2p/topics/810-how-to-enable-ssl-for-i2cp
You may change the domain name or use a "real" cert signed by a CA. Be sure to update the passwords in router.config if you do this. When running SSL for I2CP, ALL external clients must use SSL. Internal clients (i2psnark, BOB, SAM, i2ptunnel, etc.) are not affected.