You can actually distinguish between those on a single port using http://nginx.org/r/ssl_preread and some sslh-like checks using e.g. njs.