I have problems having multiple Downstreams.
It looks like I have nailed it down to the problem missunderstanding on how filter_chain_match is used correclty.

Having it like the example below it does not seems to match any request so not response.
If I remove:

        - filter_chain_match:
            server_names: ["sub1.foo.com"]

Everything works.

The final goal would be to have multiple filter_chain entries. For each subdomain. As each of them use their own certificates.

Listeners:

---
static_resources:
  listeners:
    - name: main_listener
      address:
        socket_address:
          address: 0.0.0.0
          port_value: 443
      filter_chains:
        - filter_chain_match:
            server_names: ["sub1.foo.com"]
          transport_socket:
            name: envoy.transport_sockets.tls
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
              common_tls_context:
                tls_certificates:
                  private_key:
                    filename: /etc/envoy/certs/serverkey_family.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                  certificate_chain:
                    filename: /etc/envoy/certs/servercert_family.pem
                    watched_directory:
                      path: /etc/envoy/certs/
                alpn_protocols:
                  - h2,http/1.1
          filters:
            - name: envoy.filters.network.http_connection_manager
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
                stat_prefix: ingress_http_family
                http_filters:
                  - name: envoy.filters.http.router
                    typed_config:
                      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
                route_config:
                  name: route_family
                  virtual_hosts:
                    - name: vm_family
                      domains: ["sub1.foo.com"]
                      routes:
                        - match: { prefix: "/" }
                          route: { cluster: cluster_heritagearchive }