Nah, I think @doudou here would be happy if, after they clicked past the bad cert warning, then they got the 500 page.
So a 99-year self-signed cert for the IP address would be fine.
One of many how-to guides for that: http://www.cyberciti.biz/faq/nginx-self-signed-certificate-tutorial-on-centos-redhat-linux/