So far we don't enable the SNI extension when communicating with upstream. If upstream server depends on SNI to select proper certificate, then the TLS/SSL handshaking will fail. So we should carry the SNI extension.

Nginx has a directive named proxy_ssl_server_name.

Syntax: proxy_ssl_server_name on | off;
proxy_ssl_server_name 

Just like ingress-nginx:

https://github.com/kubernetes/ingress-nginx/blob/master/docs/kubectl-plugin.md.