Common practice is to use a reverse-proxy / load-balancer like Traefik or NGINX + Certbot. Personally I use Traefik for all the TLS on Chirpstack.
At the bottom of this thread is my configuration: How to Secure MQTT Messages on ChirpStack to Prevent Unauthorized Access? - #21 by Liam_Philipp