I'm currently setting up a (semi-serious) server with nginx for the first time. I have a couple of domains and subdomains and want to use SSL as much as possible to keep the traffic to and from my site reasonably secure. A problem that I have run into lately is that I find myself unable to properly handle SSL-requests to non-existant subdomains without resorting to wildcard certificates.
Basically, my setup is very close to this one (nginx, redirects to https, multiple subdomains, Let's Encrypt certificates for all valid subdomains, catch-all for invalid domains).
It's really NotNice™ that users who misstype a subdomain will get an error along the lines of "This connection can not be trusted" (or worse, depending on browser). It might undermine trust in my website. For example
https://www.my-domain.com works but
https://ww.my-domain.com will tell the user that my site is not to be trusted. Since I'm expecting a substantial amount of my readership to be not exactly tech-savvy I can't expect them to understand or diagnose this themselves.
So what I want is to basically just abort the connection when somebody visits a non-existing subdomain, so that they get a "connection refused" error, not a "this site is evil you might be getting hacked" error. Not only is it closer to the truth (the site can be trusted, there's just nothing there), it might also help them spot their error since it's pointing out that the address is wrong and not the certificate.
In fact, that's already what I do for non-SSL connections. I have a catchall server directive in nginx that just returns 404 for anything that comes in on port 80 and doesn't match a known subdomain. So how would I go about actually flat out refusing an ssl connection in nginx?
I know I can't use HTTP return codes since in this case there is no connection in the first place. That's the whole point of ssl. I can't use wildcard certificates since they are too expensive. I would like to avoid touching iptables since that's awkward to maintain when I change subdomains. However, if that's the best solution I might look into it. Are there any clever DNS entries that could help?