A certificate is issued for specific names, and the client matches the address against them.
The second site on this server, shop.lab.test, works without complaints. But some old links point to www.shop.lab.test, and nginx answers on both names. Check them.
Open shop at two addresses
Request https://shop.lab.test/ and https://www.shop.lab.test/, then look at the names in the shop certificate.
First, predict
In nginx, both names lead to the same server block. What will curl print for www.shop.lab.test?
Now start the exercise, run the command and compare your prediction with the output.
The site's names are written in the SAN extension — Subject Alternative Name. curl looks for the name from the address in that list, letter for letter, and modern clients do not use the CN in the subject for the check. www.shop.lab.test is a separate name, and since it is not in the SAN, the check failed.
How did nginx know which certificate to send? The client passes the site name at the very start of TLS, before any HTTP — this is SNI. nginx picks the server block and its certificate by it, the same way it picks a site for HTTP by the Host header. For www.shop.lab.test it found the shop server, and nginx sent the shop certificate with its single name.
openssl s_client takes the SNI name from -connect. When connecting by address, the name is given separately: -servername shop.lab.test.