listen 443 ssl http2;
listen [::]:443 ssl http2;

server {
   listen 443 ssl;
   listen [::]:443 ssl;

   server_name _;
   return 444;
}

if ($host != "example.com") {
        return 444;
}

server {
  listen 443 ssl default_server;
  listen [::]:443 ssl default_server; # not sure if you want/need it here as well. Try both ways.

 server_name _;
 return 444;
}

server {
  listen 443 ssl default_server;
  server_name <SERVER-IP>;
  return 444;
}

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout privateKey.key -out certificate.crt -subj '/CN=<SERVER-IP>'

server {
    listen 443 ssl default_server;
    server_name <server-ip>;
    ssl_certificate         /path/to/certificate.crt;
    ssl_certificate_key     /path/to/privateKey.key;
    return 444;
}

openssl s_client -connect <SERVER-IP>:443