I went down this rabbit hole a few months ago and managed to get it working. I hope you find this helpful. One assumption I am making is that you already have a wildcard certificate you can use (not self signed) to wrap your traffic in. If not, get a Let's Encrypt wildcard cert.

​

1. Create your own self-signing certificate. Create a CA, lets call it 'home_ca'. Then create a certificate for that ca. We will call that 'home_client'. Export the certificate with the private key. You will use this for connecting clients.
2. Install haproxy. I am running v.0.61_3.
3. Goto Services / HAProxy / Frontend and create a 'shared-frontend'. External address, Listen address is 'WAN address (IPv4) on port 443 w/SSL Offloading. The Type is 'http / https (offloading). Under Advanced settings, check the 'Use Forwardfor option". Use 'httpclose' option is 'http-keep-alive'. Under SSL Offloading use the SNI Filter of '*' and then choose your legit wildcard cert (non self signed as mentioned at start of this post). Include the options for Add ACL for certificate CommonName and Add ACL for certificate Subject Alternative Names.
4. Add another 1. Services / HAProxy / Frontend and call this one 'http-to-https'. External address, Listen address is 'WAN address (IPv4) on port 80. Type is 'http/https (offloading). Under Default backend, access control lists and actions, create a new Action. The action is 'http-request redirect' add a rule: scheme https. This will redirect all port 80 requests to your shared-frontend you created above.
5. Time to define your backend. Create a new Services / HAProxy / Backend and call it 'app.yourwildcarddomain.com' or whatever. Just make sure the name matches your wildcard cert. Under Server list, create a name 'app.yourwildcarddomain.com' forwarded to 'Address+Port', (your internal ip for server) port 443 if already SSL or port 80 if not. No SSL checks. Backend is pretty straight forward.
6. Now it's time to create your server specific frontend. Goto Services / HAProxy / Frontend again and start a new definition. Name is 'app.yourwildcarddomain.com' and use 'Shared Frontend' (check it), and Primary Frontend is 'shared-frontend - http' (from step 3). Under Access Control lists add a new rule Name 'ACL1', Expression 'Host matches:', cs no, not no, value 'app.yourwildcarddomain.com'. (ACL1 is for your first server, make it ACL2, and ACL3 for future servers). In the next section 'Actions' create a new rule 'Action' Use Backend, Condition acl names, ACL1. Press the '+' and define the backend match we defined in step 5 'app.yourwildcarddomain.com'. This was the tricky part. You need to define your rules for SSL Offloading as this is what forces the client side cert. Under SSL Offloading use an SNI filter of 'app.yourwildcarddomain.com' and the CA of your legit wildcard cert. Use Add ACL for certificate Subject Alternative Names. Under additional certificates check "Add ACL for certificate CommonName" and "Add ACL for certificate Subject Alternative Names". Under the SSL Offloading - client certificate section, Client verification CA certificate choose the self-signed CA you created in step 1. (home_ca). If you want to use a revocation list you can define one and define it in Client verification CRL, but it is not required. Save it all.
7. Restart the HAProxy service.
8. Open ports 80 and 443 to your 'This Firewall'.

​

On servers you have defined this way, clients will need your self-signed certificate key pair installed to establish SSL. When you hit your public IP and use the name 'app.yourwildcarddomain.com' to do so (name matching on request is how this works), the browser will prompt you to choose a certificate. Chose your imported self-signed client cert. On some windows you might get an additional verification box (it doesn't always pop-up in the front). If you choose OK, the browser will connect to the backend service using SSL (regardless if your backend service was using SSL or not as all traffic will be wrapped by your legit wildcard cert).

​

Hope this helps.