Strict host matching: SNI and HTTP Host value differ

## 1. Which version of Caddy are you using?

abiosoft/caddy:php-no-stats

sha256:458bd53bc567430cadd65a8d7e9a0dfc0c28ee5d4f9a9d5cf854d3dde4edeef9

_(don't know why I'm still using the php version, since I'm running my own fpm server)_

## 2. What are you trying to do?
I'm hosting some services mainly in Docker containers and using Caddy as reverse proxy.
I want to secure some subdomains with client cert authentication. (certs are accepted as valid client authentication by caddy)

## 3. What is your Caddyfile?
(Removed some hosts, because they are all configured almost the same and replaced my root domain with \)
```text
# HTTP Redirects
http:// http://*. http://*.*. {

import snippets/logging
import snippets/sec-headers

redir https://{hostonly}{uri}

}

# Rootdomain
https:// https://www. {

import snippets/logging
import snippets/tls
import snippets/sec-headers

redir {
if {hostonly} is "www."
/ https://{uri}
}

import sites/

}

# Subdomains
https://admin. {

import snippets/logging
import snippets/tls-client-verify
import snippets/sec-headers

import sites/admin.

}

https://cloud. {

import snippets/logging
import snippets/tls
import snippets/sec-headers

import sites/cloud.

}

https://private. {

import snippets/logging
import snippets/tls-client-verify
import snippets/sec-headers

import sites/private.

}

https://p. {

import snippets/logging
import snippets/tls
import snippets/sec-headers

redir https://private.

}
```

snippets/tls:
```text
tls /root/.caddy/ssl/fullchain.pem /root/.caddy/ssl/privkey.pem
```

snippets/tls-client-verify:
```text
tls /root/.caddy/ssl/fullchain.pem /root/.caddy/ssl/privkey.pem {
clients /root/.caddy/ssl/ca.crt
}
```

***(I'm using an existing wildcard cert from letsencrypt (valid, of course))***

snippets/sec-headers:
```text
header / {
# Static Headers
X-Xss-Protection "1; mode=block"
X-Content-Type-Options "nosniff"
X-Robots-Tag "none"
X-Permitted-Cross-Domain-Policies "none"
X-Download-Options "noopen"
Referrer-Policy "strict-origin-when-cross-origin"
Cache-Control "public, max-age=15, must-revalidate"
Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
# Server Signature
Server ""
# Dynamic Headers
X-Frame-Options "SAMEORIGIN"
Feature-Policy "accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'self'; camera 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; payment 'none'; picture-in-picture *; speaker 'none'; sync-xhr 'none'; usb 'none'; vr 'none'"
Content-Security-Policy "upgrade-insecure-requests"
}
```

## 4. How did you run Caddy (give the full command and describe the execution environment)?

With Docker Compose on Ubuntu Server LTS 18.04:

docker-compose version 1.17.1, build unknown
docker-py version: 2.5.1
CPython version: 2.7.15+
OpenSSL version: OpenSSL 1.1.1c 28 May 2019

```text
version: '3'
services:

caddy:
image: abiosoft/caddy:php-no-stats
container_name: caddy
hostname: caddy
network_mode: host
volumes:
- /var/www:/srv
- /etc/caddy/Caddyfile:/etc/Caddyfile:ro
- /etc/caddy/snippets:/etc/snippets:ro
- /etc/caddy/sites:/etc/sites:ro
- /etc/caddy/templates:/etc/templates:ro
- /etc/caddy/data:/root/.caddy
- /etc/caddy/logs:/logs/caddy
labels:
com.centurylinklabs.watchtower.enable: "true"
depends_on:
- fpm-server

fpm-server:
image: /leon/php:fpm-custom
container_name: fpm
hostname: fpm
network_mode: host
volumes:
- /var/www:/srv
labels:
com.centurylinklabs.watchtower.enable: "true"
```

## 5. What did you expect to see?
Server asks me for client cert when entering admin.\ or private.\.

## 6. What did you see instead (give full error messages and/or log)?
With admin.\ it works like a charm, but when entering p.\, it redirects me to private.\ (like it should) but it only displays "403 Forbidden" and not asks me for a certificate.
When requesting p.\ the following shows up in docker logs -f caddy:
```text
2019/08/14 11:34:25 [ERROR] https://private. - strict host matching: SNI (cloud.) and HTTP Host (private.) values differ
```
with the first domain given in the error message (here: cloud.\) beeing different at every server restart.

The error.log itself (declared in snippets/logging) doesn't contains anything related to this issue.