Nginx drop handshake

Hey guys!
When somebody accessing my web site through HTTPS by direct IP (not hostname) or without some special header in request => I want not only to reject this request
(which is easy for the IP => just specify in server_name proper name and for the header => just check if this header present otherwise return 444)
but also reject handshake to not show certificate for re requestor.

I read somewhere that it's not possible. But anyway.

Any ideas ?

Thanks !