Page & section: https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni#how-do-i-configure-sni-for-clusters

How do I configure SNI for clusters?

For clusters, a fixed SNI can be set in UpstreamTlsContext. To derive SNI from HTTP host or :authority header, turn on auto_sni to override the fixed SNI in UpstreamTlsContext. If upstream will present certificates with the hostname in SAN, turn on auto_san_validation too. It still needs a trust CA in validation context in UpstreamTlsContext for trust anchor.

All the links in this paragraph are currently broken.