SNI-based routing only works if every TLS listener sees the ClientHello hostname before a default cert is chosen. Pin one certificate map (or per-Host secret) on the edge proxy, keep fallback certs for unknown names so misrouted names fail closed, and do not terminate TLS on both the outer load-balancer and the inner proxy unless SNI is forwarded intact. Route by exact Host first; wildcards hide stale backends until a canary Host proves the new pool.
Ops prove-out: open TLS to each Host and confirm the leaf CN/SAN matches the name you expect, then compare status codes and upstream timing against the pre-cut baseline. If only one Host fails handshake, check SNI passthrough and that the inner listener still receives the original name. If handshakes succeed but the wrong backend answers, verify Host-to-upstream maps and that DNS still points at the proxy that owns those certs — most SNI bugs are name mismatch or double termination, not the routing table shape.
Edge Ops
SNI-based routing only works if every TLS listener sees the ClientHello hostname before a default cert is chosen. Pin one certificate map (or per-Host secret) on the edge proxy, keep fallback certs for unknown names so misrouted names fail closed, and do not terminate TLS on both the outer load-balancer and the inner proxy unless SNI is forwarded intact. Route by exact Host first; wildcards hide stale backends until a canary Host proves the new pool.
Ops prove-out: open TLS to each Host and confirm the leaf CN/SAN matches the name you expect, then compare status codes and upstream timing against the pre-cut baseline. If only one Host fails handshake, check SNI passthrough and that the inner listener still receives the original name. If handshakes succeed but the wrong backend answers, verify Host-to-upstream maps and that DNS still points at the proxy that owns those certs — most SNI bugs are name mismatch or double termination, not the routing table shape.