Kubernetes tls for tcp subdomain

Traefik Traefik v2 (latest)
1

Hi,

I have following in traefik.toml

    [global]
      checkNewVersion = true

    [entryPoints]
      [entryPoints.web]
        address = ":80"
      [entryPoints.websecure]
        address = ":443"
      [entryPoints.tcp5050]
        address = ":5050"

and following IngressRouteTCP

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mosquitto-external
  namespace: dev
spec:
  entryPoints:
    - tcp5050
  routes:
  - match: HostSNI(`*`)
    kind: Rule
    services:
    - name: mosquitto
      port: 5050
  tls:

This one works perfectly. But can't reuse entryPoints tcp5050 for any other host. I tried to make IngressRouteTCP specific to HostSNI like this

apiVersion: traefik.containo.us/v1alpha1
kind: IngressRouteTCP
metadata:
  name: mosquitto-external
  namespace: dev
spec:
  entryPoints:
    - tcp5050
  routes:
  - match: HostSNI(`mosquitto.dev.domain.com`)
    kind: Rule
    services:
    - name: mosquitto
      port: 5050
  tls:
    passthrough: true

But it this doesn't work at all.

What I am missing here ?