mTLS succeeds for one hostname but fails for another on the same service

A service behind one proxy works for its main hostname and starts failing trust or hostname checks on another alias.