The clients connecting to the virtual host must provide a client certificate that was issued by the same CA that issued the server's certificate.

The virtual host is served only to clients that support SNI.

All of the names of the virtual host must be within the same DNS zone.

The virtual host is used as a fallback default for all clients that do not support SNI.

Despite its configuration, the virtual host is served only on the common name and Subject Alternative Names of the server certificates.