diff --git a/nginx-proxy/README.md b/nginx-proxy/README.md
index acda81f..daca24a 100644
--- a/nginx-proxy/README.md
+++ b/nginx-proxy/README.md
@@ -115,6 +115,28 @@ deny all;
 
 ---
 
+## SSL Certificate Handling
+
+### Certificate Lookup
+
+The proxy automatically detects SSL certificates from `/etc/nginx/certs/`:
+
+```bash
+/etc/nginx/certs/example.com.crt
+/etc/nginx/certs/example.com.key
+```
+
+### Fallback Certificate Behavior
+
+When a vhost is accessed via HTTPS but no matching certificate is found:
+
+1. **If default certificate exists:** Uses `/etc/nginx/certs/default.crt` and returns 503
+2. **If no default certificate:** Rejects the SSL/TLS handshake
+
+Either way the vhost never gets another site's certificate. Without a default certificate, nginx used to answer such a request with the certificate of the first HTTPS vhost.
+
+---
+
 ## Environment Variables
 
 | Variable | Description | Default |
diff --git a/nginx-proxy/nginx.tmpl b/nginx-proxy/nginx.tmpl
index 2cca9e8..910326d 100644
--- a/nginx-proxy/nginx.tmpl
+++ b/nginx-proxy/nginx.tmpl
@@ -460,7 +460,7 @@ server {
 	{{ end }}
 }
 
-{{ if (and (not $is_https) (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
+{{ if (not $is_https) }}
 server {
 	server_name {{ $host }};
 	listen 443 ssl {{ $default_server }};
@@ -469,10 +469,17 @@ server {
 	listen [::]:443 ssl {{ $default_server }};
 	http2 on;
 	{{ end }}
-	return 500;
 
+	{{ if (and (exists "/etc/nginx/certs/default.crt") (exists "/etc/nginx/certs/default.key")) }}
+	# Use default certificate as fallback
 	ssl_certificate /etc/nginx/certs/default.crt;
 	ssl_certificate_key /etc/nginx/certs/default.key;
+	{{ else }}
+	# No valid certificate for this vhost nor default certificate found, so reject SSL handshake
+	ssl_reject_handshake on;
+	{{ end }}
+
+	return 503;
 }
 {{ end }}