diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 85b3a31c..65e874f6 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -148,6 +148,12 @@ http {
         listen 443 default_server ssl backlog=4096;
         listen [::]:443 default_server ssl backlog=4096;
         ssl_reject_handshake on;
+
+        # work around unreliable ssl_reject_handshake
+        keepalive_timeout 0;
+        location / {
+            return 404;
+        }
     }
 
     server {