diff --git a/internal/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go
index ed052e4ec..ffaab0e3e 100644
--- a/internal/ingress/controller/template/template.go
+++ b/internal/ingress/controller/template/template.go
@@ -1404,6 +1404,12 @@ func buildHTTPSListener(t, s interface{}) string {
 		return ""
 	}
 
+	for _, server := range tc.Servers {
+		if server.Hostname == hostname && server.SSLCert == nil {
+			return ""
+		}
+	}
+
 	co := commonListenOptions(&tc, hostname)
 
 	addrV4 := []string{""}
diff --git a/test/e2e/lua/dynamic_certificates.go b/test/e2e/lua/dynamic_certificates.go
index 8c9df5e71..cb19e58c0 100644
--- a/test/e2e/lua/dynamic_certificates.go
+++ b/test/e2e/lua/dynamic_certificates.go
@@ -62,6 +62,10 @@ var _ = framework.IngressNginxDescribe("[Lua] dynamic certificates", func() {
 		_, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Update(context.TODO(), ing, metav1.UpdateOptions{})
 		assert.Nil(ginkgo.GinkgoT(), err)
 
+		ing.Annotations = map[string]string{
+			"nginx.ingress.kubernetes.io/proxy-read-timeout": "20",
+			"nginx.ingress.kubernetes.io/load-balance":       "ewma",
+		}
 		time.Sleep(waitForLuaSync)
 
 		ensureHTTPSRequest(f, f.GetURL(framework.HTTPS), host, host)