You don't have to serve any certificates on the default website. Web server would just fail TLS connection, since it doesn't have a certificate for it.

Not sure if this applies to all web servers, but at least Caddy and a few others support this.