In some environments where I need to put promtail on external probes I was surprised to learn that you couldn't establish TLS between promtail and a loki server. I had to instead setup nginx proxies between the external probe and our internal cluster. This was a year or so ago.
Original issue about it was: https://github.com/grafana/loki/issues/475 (looking at last comments, seems like people are still having issues to easily set it up)