Apache always loads the same vhost - apache

Question

I have the following vhosts. However the vhosts always seem to resolve to app.home when using https, the only way to make it load cloud.home is by removing app.home from the vhosts. Whichs leads me to believe that it ignores the ServerName setting.
app.home.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName app.home
ProxyPreserveHost On
ProxyRequests off
ProxyPass /api/websocket ws://localhost:8123/api/websocket disablereuse=on keepalive=on
ProxyPassReverse /api/websocket ws://localhost:8123/api/websocket disablereuse=on
ProxyPass / http://localhost:8123/ disablereuse=on keepalive=on
ProxyPassReverse / http://localhost:8123/ disablereuse=on#`
RewriteEngine on
RewriteCond %{HTTP:Upgrade} =websocket [NC]
RewriteRule /(.*) ws://localhost:8123/$1 [P,L]
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
RewriteRule /(.*) http://localhost:8123/$1 [P,L]
SSLCertificateFile /etc/letsencrypt/live/app.home/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/app.home/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
cloud.home.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName cloud.home
DocumentRoot "/var/www/cloud"
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/cloud/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/cloud.home.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/cloud.home.access.log combined
SSLCertificateFile /etc/letsencrypt/live/cloud.home/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloud.home/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Answer 1

Apache receives an encrypted connection on port 443. It then negotiates the certificate with the client's browser. But at this point, it has not read the requested domain yet. It must negotiate the certificate first to decrypt the payload.
So Apache will always use the first VirtualHost it finds that matches port 443. It gets the certificate from this one.
To fix that, you have to:
setup a second IP for your second domain. So Apache will be configured to say domain1 == IP1, domain2 == IP2.
Use a different port for the second domain, like :444. But this is not convenient since it is not the default.
Use SNI. Do some research on this, too long for an explication here.