this shit was why i finally bought a TLS certificate and modded my reverse proxy to let me fan out connections from it to wherever (mostly within the VPS, but also in my VPN)

https://github.com/mleku/realy/tree/dev/cmd/lerproxy

with that you can do it using lerproxy if you have a wildcard enabled to let you do subdomains, but i found that letsencrypt were really stingy with me adding new ones to the point where i was getting certificate errors like this that broke my stuff, so i paid some 90 or so to get a full year TLS wildcard certificate for mleku.dev and never see this problem anymore... i had to modify the reverse proxy to enable the use of custom domains though, it's not difficult to configure, just an environment variable with a comma separated list that specifies names to search for certificates