Host: localhost. is not in the cert's altnames
The error message is stating that the server at https://api-dev.xyz.io/graphql believes that the incoming request is being directed to https://localhost/graphql. Therefore, it is failing because the SSL certificate is not securing https://localhost/.
Could your server-side rendering be trying to perform a fetch/API call to the same server that is doing the server-side rendering to load initial data for the render? If so, could the initial data that the client needs from the API be passed to the server-side rendering directly instead of React trying to perform an API call to itself in the server-side render?
Perhaps this tutorial could be used as an example reference.
The host name is a system-level setting below NodeJS. You'll need to have access to the the box/VM your copy of NodeJS is running on.