Precisely. Except there is no “Tailscale manage them for you”.

So you could summarize your answer as " Tailscale certificates work like let encrypt".