[cush]

How do the Certs work for https?

[FrinkleFrankle]

If you want to do this another way, Tailscale funnel can send public traffic into your tailnet Traefik supports pulling the Tailscale cert from its socket.

[watermelon0]

I'd assume it uses a single wildcard certificate.

[klipitkas]

Yes, thats exactly how it works for the multiple subdomains.