Tailscale's certs are 1-per-machine so if you want to do any kind of SNI-based certificate handling, you're out of luck and need to drop back to real public certificates anyway.