Due to the nature of how SSL works, the SSL/TLS handshake is performed before the intended hostname is given to the web server. This means that the default (first) certificate is used when trying to access the site, regardless of the domain name used.
This is true with both Apache and nginx.
From the Apache Wiki:
As a rule, it is impossible to host more than one SSL virtual host on
the same IP address and port. This is because Apache needs to know the
name of the host in order to choose the correct certificate to setup
the encryption layer. But the name of the host being requested is
contained only in the HTTP request headers, which are part of the
encrypted content. It is therefore not available until after the
encryption is already negotiated. This means that the correct
certificate cannot be selected, and clients will receive certificate
mismatch warnings and be vulnerable to man-in-the-middle attacks.
From the nginx documentation:
With this configuration a browser receives the default server’s
certificate, i.e. www.example.com regardless of the requested server
name. This is caused by SSL protocol behaviour. The SSL connection is
established before the browser sends an HTTP request and nginx does
not know the name of the requested server. Therefore, it may only
offer the default server’s certificate.
How can you resolve this issue?
The easiest solution is to use separate IP addresses for each site you wish to secure.
If this is not possible, it might be possible to resolve the issue using Server Name Indication (SNI, RFC 6066). This allows a browser to pass the domain name to the server during the handshake.
Both Nginx and Apache support SNI. You can find out more on nginx SNI in the documentation.
It's worth noting that SNI can only be used for domain names, and not IP addresses. You should take extra precaution when configuring your web servers to address this issue, so any request to the IP is handled properly.
Only domain names can be passed in SNI, however some browsers may
erroneously pass an IP address of the server as its name if a request
includes literal IP address. One should not rely on this.
The Apache Wiki has some more information on implemeting SNI. But even their documentation advises that this solution is not perfect.
Using name-based virtual hosts with SSL adds another layer of
complication. Without the SNI extension, it's not generally possible
(though a subset of virtual host might work). With SNI, it's necessary
to consider the configuration carefully to ensure security is
With that said, you can see how this configuration isn't as simple as regular virtual hosts. In order to further come up with a solution to your problem, we would need to know more details on your configuration and the expected behavior when an IP only request is sent.
Generally, to 'block' a non configured domain or IP request, you would configure it as the default site and then display an error, redirect, exit, etc.