Wrong certificate

We have one fronted configured by a Kubernetes IngressRoute:

kind: Middleware
metadata:
  name: mymiddleware
spec:
  headers:
    customRequestHeaders:
      l5d-dst-override: myapp.example.com:80
    customResponseHeaders:
      l5d-remote-ip: ""
      l5d-server-id: ""
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
  name: his-flex-web-dev
spec:
  routes:
  - kind: Rule
    match: Host(`myapp.example.com``)
    middlewares:
    - name: mymiddleware
    services:
    - kind: Service
      name: myapp
      port: 80
  - kind: Rule
    match: HostRegexp(`{regexpmatch:.*}.myapp.example.com`)
    middlewares:
    - name: mymiddleware
    services:
    - kind: Service
      name: myapp
      port: 80
  tls:
    secretName: mycert

When we use the first rule, we get the certificate saved on the kubernetes secret mycert, but when we use the other endpoint, traefik produces a self-signed certificate, which shouldn't even be possible as we set a cert on the default certstore (which also happens to be mycert)

curl -vk https://myapp.example.com/health 2>/dev/stdout | grep subject.*CN
*  subject: C=US; ST=AA; L=MyCity; O=My Company; OU=My Department; CN=*.example.com
curl -vk https://appmodifier.myapp.example.com/health 2>/dev/stdout | grep subject.*CN
*  subject: CN=TRAEFIK DEFAULT CERT

default cert config:

data:
  config.toml: |-
    [[tls.certificates]]
        certFile = "/certs/tls.crt"
        keyFile = "/certs/tls.key"