If you want to offer HTTPS from start you must provide a certificate accepted by the client from start. Because otherwise the client will not accept the SSL connection and you will not be able to redirect the client to a different site or a HTTP-only version. This means to support this case you
- either need to have a single certificate containing all your domains, so that you can provide non-SNI clients with a proper certificate. But in this case you don't need SNI at all.
- or you have to install some default certificate which does not match most of your names. In this case you can only provide the client a different page or redirect it if the client accepts this bad certificate.
Of course this leaves everything open to man-in-the-middle attacks, because all the man-in-the-middle has to do is to serve some different certificate or make HTTPS unavailable at all, because in this case you will never try to upgrade the connection to HTTPS. Additionally this can be used to make it look like the clients supports SNI, if the man-in-the-middle does it instead. And not only non-SNI clients are affected by this but SNI-capable clients can only be intercepted. So while this would be possible in theory it is not recommended because you can simply man-in-the-middle everything and thus make the main point of using HTTPS moot.