No peer certificate for SSL resulting in UNRECOGNIZED NAME error

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

After installing NPM using the official instructions and setting up a certificate for domain x.y.com, https connections do not work at all, including the congratulations page. Trying to access the congratulations page via https results in a UNRECOGNIZED NAME error in the browser. Inspecting the certificate via openssl results in:

openssl s_client -showcerts -connect x.y.com:443
CONNECTED(00000003)
40B7D2AD887F0000:error:0A000458:SSL routines:ssl3_read_bytes:tlsv1 unrecognized name:../ssl/record/rec_layer_s3.c:1586:SSL alert number 112
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 329 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

Nginx Proxy Manager Version

2.11.2

To Reproduce
Steps to reproduce the behavior:

1. Install using the quick setup instructions from the README file.
2. In the portal, add SSL certificate for chosen domain. Using cloudflare DNS challenge, if that makes a difference.
3. Connect to chosen domain via https. Note the error.

Expected behavior

Congratulations page, as visible via plain HTTP.

Screenshots

n/a

Operating System

TrueNAS custom app deployment.

Additional context

Plain HTTP works. The domain used seems to not be the problem - tried on two different ones.

Start by reproducing the HTTPS failure on Nginx Proxy Manager 2.11.2 using the reported TrueNAS custom app deployment and the provided openssl s_client command. Compare the generated certificate and hostname handling with the plain HTTP path; done means the configured domain completes the TLS handshake and serves the congratulations page over HTTPS.