I imagine it works like this, it will automatically match the certificate from the site block when tls sni is used.
# Global Options
{
layer4 {
tcp/:465 {
@3f0824af-b877-40d5-8e60-b54df442599d tls sni mail.example.com
route @3f0824af-b877-40d5-8e60-b54df442599d {
tls
proxy tcp/localhost:3465 {
}
}
}
}
}
# Site Block
mail.example.com {
tls {
issuer acme {
dns cloudflare randomapikey
resolvers 1.1.1.1
}
}
}