Comment by TillE

Automatic unconfigured behavior is bad, but something like a ssl_certificate_auto directive that's in the default config would make a lot of sense.