diff --git a/openflare_server/service/config_version.go b/openflare_server/service/config_version.go
index 356e9cd0..6f3d5ed2 100644
--- a/openflare_server/service/config_version.go
+++ b/openflare_server/service/config_version.go
@@ -1222,7 +1222,22 @@ func renderConnectionUpgradeMap() string {
 }
 
 func renderDefaultServerBlock() string {
-	return "    server {\n        listen 80 default_server;\n        server_name _;\n\n        return 404;\n    }\n\n"
+	return strings.Join([]string{
+		"    server {",
+		"        listen 80 default_server;",
+		"        server_name _;",
+		"",
+		"        return 404;",
+		"    }",
+		"",
+		"    server {",
+		"        listen 443 ssl default_server;",
+		"        server_name _;",
+		"",
+		"        ssl_reject_handshake on;",
+		"    }",
+		"",
+	}, "\n")
 }
 
 func renderProxyHeaderBlock(originURL string, originHost string, customHeaders []ProxyRouteCustomHeaderInput, upstreamConfig routeUpstreamConfig) string {
diff --git a/openflare_server/service/https_phase1_test.go b/openflare_server/service/https_phase1_test.go
index d63809fc..fd99ee2b 100644
--- a/openflare_server/service/https_phase1_test.go
+++ b/openflare_server/service/https_phase1_test.go
@@ -949,12 +949,18 @@ func TestRenderConfigUsesDefaultServerFallback(t *testing.T) {
 	if !strings.Contains(preview.MainConfig, "listen 80 default_server;") {
 		t.Fatal("expected preview main config to include default http server")
 	}
+	if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") {
+		t.Fatal("expected preview main config to include default https server")
+	}
 	if !strings.Contains(preview.MainConfig, "server_name _;") {
 		t.Fatal("expected preview main config to include default server_name")
 	}
 	if !strings.Contains(preview.MainConfig, "return 404;") {
 		t.Fatal("expected preview main config to return 404 for unmatched hosts")
 	}
+	if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") {
+		t.Fatal("expected preview main config to reject unmatched https handshakes")
+	}
 }
 
 func TestCreateTLSCertificateRejectsInvalidPEM(t *testing.T) {
@@ -1007,6 +1013,12 @@ func TestOpenRestyMainConfigTemplateRenderAndValidate(t *testing.T) {
 	if !strings.Contains(preview.MainConfig, "listen 80 default_server;") {
 		t.Fatal("expected preview main config to preserve managed default server block")
 	}
+	if !strings.Contains(preview.MainConfig, "listen 443 ssl default_server;") {
+		t.Fatal("expected preview main config to preserve managed default https server block")
+	}
+	if !strings.Contains(preview.MainConfig, "ssl_reject_handshake on;") {
+		t.Fatal("expected preview main config to preserve managed https handshake rejection")
+	}
 
 	invalidTemplate := strings.ReplaceAll(
 		common.OpenRestyMainConfigTemplate,