Type: unauthorized Detail: Invalid response from

Is that NOT clear?
There is only one name being listened to.
What happens to requests to www.
Oh wait, anything and everything get sent to HTTPS.
But which HTTPS?
The one that works, silly.
What happens when someone types the one that doesn't work.
Duh! It doesn't work!
But what about the default?
Oh yeah the default HTTPS listener (yet unseen) has a cert with both names on it, so that should fix it.
HOW?
The default HTTPS, would send everything to the working HTTPS site of course.
You thought of everything...
Except how does this scale? I mean how will you ever add another site to this kludge?
[the default listeners are probably sending all requests to one specific server name]