Cannot set up business application rule for WAF for https when SSL VPN and User Portal use port 443 too

Hi folks.

I have a single external IP available, which I want to use with the default https port for several services:

portal example com
vpn example com
www example com

Both the user portal and the ssl vpn work as intended while sharing port 443.

An additional WAF for a https dashboard on a custom port (backup example com) also works as intended (backup, portal and vpn share an imported certificate).

But when trying to protect the new webserver via WAF, I'm having an issue with setting up the business application rule, which fails to save with the error that the User Portal is using port 443 too: "You cannot configure "443" for listening port as it is configured as user portal port."

Changing the user portal to port 4443 and trying to set up the rule again then reports the error "Service is already configured on the specified port, choose another port.", which would be the SSL VPN I set up to use port 443 too.

Is WAF unable to leverage Server Name Indication (SNI) when the User Portal and/or the SSL VPN service are using it too?

Thanks in advance for any help.