One hostname behind the same proxy passes mTLS while another fails

A service behind one proxy works on its primary hostname and fails on an alternate alias that was assumed to be equivalent.