https://portswigger.net/burp/documentation/desktop/tools/proxy/options#listenersCertificate
These settings control the server SSL certificate that is presented to SSL clients. Use of these options can resolve some SSL issues that arise when using an intercepting proxy:
You can eliminate SSL alerts in your browser, and the need to create SSL exceptions.
Where web pages load SSL-protected items from other domains, you can ensure that these are properly loaded by the browser, without the need to first manually accept the proxy's SSL certificate for each referenced domain.
You can work with thick client applications that refuse to connect to the server if an invalid SSL certificate is received.
The following options are available:
Use a self-signed certificate - A simple self-signed SSL certificate is presented to your browser, which always causes an SSL alert.
Generate CA-signed per-host certificates - This is the default option. Upon installation, Burp creates a unique, self-signed Certificate Authority (CA) certificate, and stores this on your computer to use each time Burp is run. When your browser makes an SSL connection to a given host, Burp generates an SSL certificate for that host, signed by the CA certificate. You can install Burp's CA certificate as a trusted root in your browser, so that the per-host certificates are accepted without any alerts. You can also export the CA certificate to use in other tools or other instances of Burp.
Generate a CA-signed certificate with a specific hostname - This is similar to the preceding option; however, Burp will generate a single host certificate to use with every SSL connection, using the hostname you specify. This option is sometimes necessary when performing invisible proxying, because the client does not send a CONNECT request, and so Burp cannot identify the required hostname prior to the SSL negotiation. As previously, you can install Burp's CA certificate as a trusted root.
Use a custom certificate - This option enables you to load a specific certificate (in PKCS#12 format) to present to your browser. This option should be used if the application uses a client which requires a specific server certificate (e.g. with a given serial number or certification chain).