Currently if a certificate is not found for a domain the TLS handshake will fail. An alternative to just a plain failure would be to set a default certificate. However, such a default certificate will usually cause at least a warning in most clients and some clients will completely refuse to show the page, depending on how the certificate was created.
An alternative to this could be possibly to send an error already by the HTTP redirect server and just drop the connection on the TLS side. Neither this works well if the cert was ever there and the client has cached the usual permanent redirect.