Ah, of course I figured it out now. Had to add sni req.hdr(host) to each backend server. Config looks like this:
global
…
ca-base /etc/ssl/certs
…
frontend HTTPS-Frontend-DefaultHTTPS
bind x.x.x.x:443 ssl crt /etc/ssl/chained
mode http
use_backend %[req.hdr(host),lower,map_dom(/etc/haprox/domain-backend.map)]
backend MyApp-Servers
mode http
balance roundrobin
option forwardfor
server worker01 worker01.prod.myapp.apps.company.net:443 ssl verify required ca-file ca-certificates.crt sni req.hdr(host)
server worker02 worker02.prod.myapp.apps.company.net:443 ssl verify required ca-file ca-certificates.crt sni req.hdr(host)