Logrotat runs with hardening features (/lib/systemd/system/logrotate.service)
which prevents write access to /etc.

You will find the tls_domains file at /var/lib.