diff --git a/tsnet/example/tshello/tshello.go b/tsnet/example/tshello/tshello.go
index 8bdfc9263..57b8fa2a4 100644
--- a/tsnet/example/tshello/tshello.go
+++ b/tsnet/example/tshello/tshello.go
@@ -6,6 +6,8 @@
 package main
 
 import (
+	"crypto/tls"
+	"flag"
 	"fmt"
 	"html"
 	"log"
@@ -16,12 +18,22 @@
 	"tailscale.com/tsnet"
 )
 
+var (
+	addr = flag.String("addr", ":80", "address to listen on")
+)
+
 func main() {
+	flag.Parse()
 	s := new(tsnet.Server)
-	ln, err := s.Listen("tcp", ":80")
+	ln, err := s.Listen("tcp", *addr)
 	if err != nil {
 		log.Fatal(err)
 	}
+	if *addr == ":443" {
+		ln = tls.NewListener(ln, &tls.Config{
+			GetCertificate: tailscale.GetCertificate,
+		})
+	}
 	log.Fatal(http.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		who, err := tailscale.WhoIs(r.Context(), r.RemoteAddr)
 		if err != nil {