I think it could be useful to see the SNI in the TCP access_log https://www.envoyproxy.io/docs/envoy/latest/configuration/access_log#config-access-log-format.