Google is trying to prevent verifying hostnames in TLS certs by any other means than sending the hostname in unencrypted clear text over the wire: SNI.Haproxy allows for verifying hosts without SNI, using the option verifyhost(www.google.com) on the server directive line.^1Many, in fact probably most, websites using TLS on the internet do not require SNI, despite the popularity of some very large shared hosting companies.Most sites (cf. URLs) posted to HN using TLS do not require SNI.(A major browser will send SNI anyway, unencrypted clear text hostname over the wire, even when it is not necessary.)(TLS 1.3 fixes the problem but it is only available for Cloudflare-hosted sites at the present time.)Let's look at an illustration.    example.com

    echo |openssl s_client -showcerts -connect 93.184.216.34:443 |openssl x509 -text -noout |less

No SNI sent.  We are give a number of SANs we can check against.DNS:example.com is there.Cheers.    www.amazon.com

echo |openssl s_client -showcerts -connect 23.46.215.151:443 |openssl x509 -text -noout |lessNo SNI sent.  We are given a number of SANs to check against.DNS:www.amazon.com is there.Cheers.     www.google.com

     echo |openssl s_client -showcerts -connect 172.217.17.68:443 |openssl x509 -text -noout |less

WTF.Fix your company.  Everyone else can return a cert with a list of SANs.1. Funny that one can verify www.haproxy.com using the default "verify required" but not www.haproxy.org.  There is no SAN for www.haproxy.org at 51.15.8.218.  The cert only lists some SANs for formilux.org