This video demo how to configure TLS Context for a Private Space and encrypt the inbound traffic to private space. Demo explains following in detail:
Configure Vanity Domain CNAME and A record
Generate private key and public using Common Name, Subject Alternative Name and wildcard common name
Configure TLS context using public key and private key
Configure TLS context using wild card certificate and private key