Never use ssl_fc_sni
if you can use hdr(hosts)
.
On the backend servers, specify SNI for health checks and traffic:
sni str(api-test-haproxy.neatoserver.lan) check-sni api-test-haproxy.neatoserver.lan
so that Apache SSL Vhost can actually match something.