I need to enable SNI support on the NGINX client:
proxy_ssl_server_name on;
http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_server_name
proxy_ssl_server_name on;
http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_server_name