464b33a176
Without proxy_ssl_server_name on, nginx connects to Cloudflare's IP without SNI, triggering handshake_failure (alert 40). Cloudflare requires SNI to route TLS to the correct origin.