It’s specified in the RFC for HTTP/2 as connection reuse, but tl;dr: If the IP address of host A and B overlap (e.g. host A and B both resolve to 192.0.2.16), and host A presents a TLS cert that also includes B (via explicit CN/SAN or wildcard cert), then the client is allowed to send HTTP requests directed to B on the connection that was established to A. The server can’t have a freestanding TLS termination layer, that routes to HTTP servers based on SNI. Reject all requests on a connection that don’t match the first request.