I'm looking for a specific answer regarding the TLS handshake in a scenario of domain-fronting.
Following [hensonsecurity](https://hensonsecuritytools.wordpress.com/2019/11/02/how-domain-fronting-attacks-work-explained-in-seven-steps/) and [zscaler](https://www.zscaler.com/blogs/security-research/analysis-domain-fronting-technique-abuse-and-hiding-cdns) blogs I have noticed that a detailed description **regarding the re-direct / routing scheme is missing when the CDN finishes the legitimate TLS hand-shake and it sees that the GET is to another domain that hosted in it.
If there is a redirect command, is there a new ssl hand-shake with the domain itself (if it has imported its own private cert?)**