As others have noted, I'm not sure what this adds unless you cannot use letsencrypt to get wildcard certs. I wrote about that here: https://blog.katarismo.com

As others have noted, I'm not sure what this adds unless you cannot use letsencrypt to get wildcard certs. I wrote about that here: https://blog.katarismo.com/2023-06-04-expose-any-private-service-using-headscale https://blog.katarismo.com/2023-06-04-expose-any-private-ser... All my internal and external services inside and outside of my headscale/tailscale network can use a single cert this way. I generate a single cert and then reuse it everywhere.