I read through the codebase and can't assert that couldn't happen... wasn't sure if the ngx_http_ssl_certificate callback could be executed after a point where any of the client-controlled variables from [1] are defined.

[1] - https://nginx.org/en/docs/http/ngx_http_ssl_module.html#vari...