In case someone experience the same issue and above directives are not enough, you will need to use "proxy_ssl_name name" - https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_name:

proxy_ssl_server_name on; #mandatory

proxy_ssl_protocols TLSv1.3; #sometimes is needed

proxy_ssl_name myfqdn.com;

Why? Sometimes proxy_set_header Host myfqdn.com; is not enough to satisfy upstream group server's SNI.