It's not. It's supposed to use a publicly routable address. Private addresses were an unfortunate hack that got massively overused when people would've been much better off putting the same effort into using IPv6.
If this is truly disconnected from the Internet then yeah HTTPS is unsuitable - it fundamentally relies on the idea that there's a central, universal definition for who owns "foo.com" so that users can rely on talking to the correct "foo.com".