Yeh true. But what I do in those scenarios is hack up an ngnix config with a (self-signed) wildcard certificate and map certain ports to https endpoints on certain subdomains using ngnix reverse-proxy stuff.

So I expose :9000 on the remote host, and then map :9000 to blah.my.website.com:443 using ngnix