Yeah, maybe the default Apache VHost is handling it
What does this show?
sudo grep -iR sslcertificate /etc/apache2/*
Although, if the default VHost was handling it then it must also be doing proxy as otherwise we wouldn't see the response header saying Mojolicious. We would also have to see Proxy Preserve Host which we don't see.
I really think the port routing is still the most likely reason.