diff --git a/modules/50-hardening.sh b/modules/50-hardening.sh
index 382103d..175f34e 100755
--- a/modules/50-hardening.sh
+++ b/modules/50-hardening.sh
@@ -322,14 +322,25 @@ EOF
 
   # ── default catch-all server: unmatched Host -> drop ──
   if [[ ! -f "$d/_on/00-default.conf" ]]; then
+    # The default_server also listens on 443 to catch unknown-SNI TLS clients.
+    # It needs SOME cert to complete the handshake before `return 444` drops them;
+    # angie won't start a 443 listener without ssl_certificate. Generate a self-signed
+    # dummy once (CN='bootstrap-default', 10y) so unknown-SNI clients get dropped
+    # after connecting while real vhosts are picked by SNI.
+    if [[ ! -f "$d/ssl/bootstrap-default.crt" ]]; then
+      sudo_ install -d -m 0755 "$d/ssl"
+      sudo_ openssl req -x509 -newkey rsa:2048 -nodes -days 3650 -keyout "$d/ssl/bootstrap-default.key" -out "$d/ssl/bootstrap-default.crt" -subj "/CN=bootstrap-default/O=bootstrap" 2>/dev/null
+    fi
     sudo_ tee "$d/_on/00-default.conf" >/dev/null <<'EOF'
 # default_server: drop requests that match no enabled host (drive-by scanners, bare-IP)
 server {
     listen 80 default_server;
     listen [::]:80 default_server;
-    listen 443 default_server;
-    listen [::]:443 default_server;
+    listen 443 ssl default_server;
+    listen [::]:443 ssl default_server;
     server_name _;
+    ssl_certificate     /etc/angie/ssl/bootstrap-default.crt;
+    ssl_certificate_key /etc/angie/ssl/bootstrap-default.key;
     return 444;
 }
 EOF