Two workloads on the same port

Use req.ssl_sni:

tcp-request inspect-delay 5s
tcp-request content accept if { req.ssl_hello_type 1 }

use_backend recir-client-auth if { req.ssl_sni -i clients.example.org }
use_backend recir-default if { req.ssl_sni -i www.example.org }