You can use lets encrypt with dns tests from wide variety of providers. Also you can selfhost the control server of tailscale (headscale).