Can't create tailscale cert in new binaries

### What is the issue?

In 1.36.2 I can make a cert but the version is too much outdated on the dashboard so I tried the latest (1.70.0) and I get the message:

500 Internal Server Error: acme.GetReg: Get "https://acme-v02.api.letsencrypt.org/directory": tls: failed to verify certificate: x509: certificate signed by unknown authority

But in other programs it works:

```
~ $ curl https://acme-v02.api.letsencrypt.org/directory -v
* Host acme-v02.api.letsencrypt.org:443 was resolved.
* IPv6: 2606:4700:60:0:f53d:5624:85c7:3a2c
* IPv4: 172.65.32.248
* Trying 172.65.32.248:443...
* Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /data/data/com.termux/files/usr/etc/tls/cert.pem
* CApath: /data/data/com.termux/files/usr/etc/tls/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / x25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
* subject: CN=acme-v02.api.letsencrypt.org
* start date: Jul 2 23:09:08 2024 GMT
* expire date: Sep 30 23:09:07 2024 GMT
* subjectAltName: host "acme-v02.api.letsencrypt.org" matched cert's "acme-v02.api.letsencrypt.org"
* issuer: C=US; O=Let's Encrypt; CN=R10
* SSL certificate verify ok.
* Certificate level 0: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
* Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://acme-v02.api.letsencrypt.org/directory
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: acme-v02.api.letsencrypt.org]
* [HTTP/2] [1] [:path: /directory]
* [HTTP/2] [1] [user-agent: curl/8.8.0]
* [HTTP/2] [1] [accept: */*]
> GET /directory HTTP/2
> Host: acme-v02.api.letsencrypt.org
> User-Agent: curl/8.8.0
> Accept: */*
>
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
< HTTP/2 200
< server: nginx
< date: Tue, 23 Jul 2024 12:51:15 GMT
< content-type: application/json
< content-length: 746
< cache-control: public, max-age=0, no-cache
< x-frame-options: DENY
< strict-transport-security: max-age=604800
<
{
"k15ux13KKfc": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
"keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
"meta": {
"caaIdentities": [
"letsencrypt.org"
],
"termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf",
"website": "https://letsencrypt.org"
},
"newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
"newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
"newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
"renewalInfo": "https://acme-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo",
"revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
* Connection #0 to host acme-v02.api.letsencrypt.org left intact
```
```
~ $ echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head Connecting to 172.65.32.248
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
verify return:1
depth=1 C=US, O=Let's Encrypt, CN=R10
verify return:1
depth=0 CN=acme-v02.api.letsencrypt.org
verify return:1
CONNECTED(00000003)
---
Certificate chain
0 s:CN=acme-v02.api.letsencrypt.org
i:C=US, O=Let's Encrypt, CN=R10
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Jun 25 20:21:41 2024 GMT; NotAfter: Sep 23 20:21:40 2024 GMT
1 s:C=US, O=Let's Encrypt, CN=R10
i:C=US, O=Internet Security Research Group, CN=ISRG Root X1
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
DONE
```

### Steps to reproduce

1. cd go/bin
2. curl -fsSL https://pkgs.tailscale.com/stable/tailscale_1.70.0_arm64.tgz | tar xzv
3. mv tailscale_1.70.0_arm64/tailscale .
4. mv tailscale_1.70.0_arm64/tailscaled .
5. rm tailscale_1.70.0_arm64/ -r
6. chmod 700 tailscale
7. chmod 700 tailscaled
8. cd
9. tailscaled
10.
11. tailscale up
12. tailscale cert

### Are there any recent changes that introduced the issue?

Version change

### OS

Android

### OS version

Linux localhost 4.19.315-perf+ #4 SMP PREEMPT Sun Jul 21 23:42:00 WEST 2024 aarch64 Android

### Tailscale version

1.70.0 tailscale commit: 0e0a212418fbf8243cb3f06634367b61e81ea9db other commit: 26f80df929d9ae698931e4dd1fbdf05f2138ff6f go version: go1.22.5

### Other software

Docker

### Bug report

BUG-9332653ad989dee45cd59da4d7506af7e782ee3a6460ce8fe1d7f755ce57e005-20240723124958Z-fe604ae2ab0ba2cf