Unable to fetch certificate for non-machine ts.net hostname ("unexpected output: no delimiter")

[YouriT]

When requesting a TLS certificate via tscert for a *.ts.net hostname that does not match the local Tailscale machine name, certificate issuance fails with:

unexpected output: no delimiter

This happens when tailscaled.sock is accessible and Tailscale itself is running correctly.

The error appears to originate from tscert (around here), and was observed via Traefik’s Tailscale certificate resolver.

This prevents using tscert for reverse proxies and dynamic services where hostnames don’t map 1:1 to a Tailscale machine.

Unless I'm missing something that I couldn't find in the docs?

Original issue: traefik/traefik#9772 + traefik/traefik#10663 (comment)

[YouriT]

It turns out that it works fine if you follow a few steps:

1. Declare a service in tailscale
2. Run tailscale serve on the target host
3. Start using the domain name