The controller and dashboard charms are designed to work with Juju 3.0 controllers - the 2.9 controller delivered the dashboard a completely different way. You can deploy the controller charm to a 2.9 model, and also the dashboard charm, but when you try and relate them the dashboard charm goes into error as the expected endpoints are not present in a 2.9 controller. We really should add “assumes juju 3.0” to those charms so that they will only deploy to 3.0 or later.
You can use tls with Letsencrypt on a 2.9 controller via the “autocert-url” and “autocert-dns-name” controller config. I’ve not done it myself - the functionality was added a long time ago before JAAS and then sort of got obsoleted by JAAS but just got carried along from release to release. There’s a post here about it but it seems there’s a couple of questions unresolved.