Cloudflare Stop serving SSL cert during direct IP Access

My main goal is to stop serving the SSL cert when connecting via https://IP_address

---

Why? because I need to hide my origin IP and currently when you connect https://ipaddress it serves the certificate for my domain which is invalid but still lists the domain name, so people can trace my domain to the origin, like what Censys does.

In CSF I want to block port 443 to all IP addresses except for Cloudflare.

My csf.allow includes all coudflare ranges listed like so:

Code:

tcp|in/out|d=80,443|s=173.245.48.0/20 # cloudflare

My csf.deny includes this:

Code:

tcp|in/out|d=80,443|s=0.0.0.0/0 # block all connections to port 80/443, except cloudflare which is whitelisted in csf.allow

This is currently working ok, is this good, bad or is there a better alternative?
As long as connection goes through cloudflare on port 80 and 443 everything is working fine. Other ports are not affected by this rule, which is good. All important things are whitelisted.

I tried a million different ways to block it via nginx rules but could not find anything that worked.

 

no matter what kind of deny rules I put in nginx, it always starts the connection by serving the SSL cert, I could not find a way around it