ssl_reject_handshake is working as intended

nginx/nginx.conf

@@ -149,8 +149,9 @@ http {
         listen [::]:443 default_server ssl backlog=4096;
         ssl_reject_handshake on;
 
-        # work around unreliable ssl_reject_handshake
         keepalive_timeout 0;
+
+        # https://trac.nginx.org/nginx/ticket/2012
         location / {
             return 404;
         }