CDNs with shared infrastructure make use of domain-fronting checks. Those validate that the target of every single request (identified by the Host or :authority

CDNs with shared infrastructure make use of domain-fronting checks. Those validate that the target of every single request (identified by the Host or :authority header) is valid for the SNI and associated TLS certificate that was used to establish the connection, and otherwise reject the request. That is actually independent of HTTP/1.1, /2 or /3, since all of those allow for multiple requests targetting different authorities on the same connection. If you build your multi-tenant webserver yourself you however obviously have to be careful regarding getting this right.