How does auto-TLS work? It makes a self signed certificate automatically?

Yes — numa install generates a local CA and stores it in the system trust store. When you register a .numa service, it generates a per-service TLS cert signed by that CA