the TLS proxy already serves HTTPS on port 443, where those clients connect; the generated self-signed certificate additionally covers each of those suffixes and *.<region>.<suffix> for every ...