I use a wireguard tunnel as a reverse proxy and it does ssl passthrough with sni. Termination happens on my local box and the reverse proxy host doesn’t do any certs.