okay part of the problem is centos 7 uses mercurial 2.6.2 and fix is to update to mercurial >2.7.9 for SNI support

hg --version
Mercurial Distributed SCM (version 2.6.2)
(see http://mercurial.selenic.com for more information)

Copyright (C) 2005-2012 Matt Mackall and others
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

use mercurial own centos 7 yum repo

/etc/yum.repos.d/mercurial.selenic.com.repo

[mercurial.selenic.com]
name=mercurial.selenic.com
baseurl=https://www.mercurial-scm.org/release/centos7
enabled=1
# Temporary until we get a serious signing scheme in place,
# check https://www.mercurial-scm.org/wiki/Download again
gpgcheck=0

yum -y update mercurial

hg --version
Mercurial Distributed SCM (version 4.0-rc)
(see https://mercurial-scm.org for more information)

Copyright (C) 2005-2016 Matt Mackall and others
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

now mercurial 4.0 with SNI support works

hg clone https://hg.nginx.org/njs/
destination directory: njs
requesting all changes
adding changesets
adding manifests
adding file changes
added 874 changesets with 3131 changes to 187 files
updating to branch default
162 files updated, 0 files merged, 0 files removed, 0 files unresolved

but still best to add *.nginx.org to *.nginx.com common name for pubserv.nginx.com server's SSL cert ?