I've had problems in the past with old DNS entries (belonging to other people) pointing to a server. To prevent the server responding and making those hostnames appear to hold exact copies of my content, I use NameVirtualHost and make the default virtual host always respond 503 forbidden. That seems to work nicely.
Now, though, I'm wondering how best to achieve the same thing with SSL.
Obviously, if a client were to request a page over HTTPS while using an unrecognised hostname, they would get SSL warnings because the certificate wouldn't match. However, they have the option of bypassing those warnings. I'd like to prevent the server from serving the content even if the client chooses to ignore the SSL warning.
It seems I can't use the same NameVirtualHost trick, since name-based virtual hosts with SSL requires SNI, which has potential compatibility issues with old clients that I would rather avoid. Instead, I have to use an IP-based virtual host. SSLRequireSSL doesn't seem to help - it's happy regardless of whether the certificate worked.
Google is an example of this, though presumably not using apache. If you edit your /etc/hosts and point some random name at a google IP address, when you visit it via SSL you first get a warning, but then if you continue anyway you get a 503 error - "Service error -27. That’s all we know".
I'm not sure this really matters all that much. The apparent duplicate site resulting from the stray DNS entry before was actually causing our content to appear in search engines under the wrong domain name. In this case, presumably (hopefully!) the search engine won't index the content if the SSL certificate is invalid.
Nonetheless, I'd like to do this right if there is a standard approach.