Thanks for the tip. I have replaced the config with

server_name example.co *.example.co

with

server_name .example.co

While that is definitely more concise it didn't solve the problem.

http://example.co - seems fine.
http://test.example.co - curl: (51) SSL peer certificate or SSH remote key was not OK

However, this is definitely a different error message so it doesn't appear to be falling back on the default SSL certificate for the server, which is a step forward.