Comment by SushiHippie

You could just get a wildcard certificate with lets encrypt, via a dns challenge.

E.g. lego supports many different dns providers

https://go-acme.github.io/lego/

And then internally inside of tailscale you could have your own dns server, which serves subdomains of your domain, and for all subdomains you can use the same wildcard certificate.

This also does not 'expose' your subdomains on Certificate Transparency logs