YARP can be used on IIS, Http.Sys (HttpListener), or Kestrel, and each handle TLS setup differently. If you didn't like the HttpListener model you should try Kestrel instead, it's all configured in process (or appsettings.json).
https://docs.microsoft.comaspnet/core/fundamentals/servers/k...
(In the end, I used HttpListener in localhost-only mode and had an off-the-shelf proxy service to deal with TLS.)