I noticed that limitation quickly too. My solution was to just point A records on my domain to the tailscale internal ip and use the let's encrypt wildcard cert

I noticed that limitation quickly too. My solution was to just point A records on my domain to the tailscale internal ip and use the let's encrypt wildcard certificate my registrar (porkbun) provides out of the box.