frontend fe_tls_passthrough
    bind :443
    mode tcp
    tcp-request inspect-delay 5s
    tcp-request content accept if { req.ssl_hello_type 1 }
    use_backend be_app1 if { req.ssl_sni -i app1.example.net }
    use_backend be_app2 if { req.ssl_sni -i app2.example.net }
    default_backend be_default

backend be_app1
    mode tcp
    server app1 10.0.20.11:443 check

backend be_app2
    mode tcp
    server app2 10.0.20.12:443 check

backend be_default
    mode tcp
    server app1 10.0.20.11:443 check