I noticed that limitation quickly too. My solution was to just point A records on my ___domain to the tailscale internal ip and use the let's encrypt wildcard certificate my registrar (porkbun) provides out of the box.