user  root;
worker_processes  1;

events {
    worker_connections  1024;
    multi_accept        on;
}


http {
    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    log_format ssltest '"ssl client serial" $ssl_client_serial  "remote_addr" $remote_addr -"remote_user" $remote_user [$time_local] "request" "$request" '
        '"status" $status "body_bytes_sent" $body_bytes_sent "http_referer" $http_referer'
        '"ssl_client_cert" $ssl_client_cert '
        '$ssl_protocol/$ssl_cipher'
        '"Client fingerprint" $ssl_client_fingerprint '
        '"X-SSL-CERT" $ssl_client_escaped_cert'
        '"ssl_client_verify=" $ssl_client_verify';

  server {
      listen 80;
      rewrite ^(.*) https://$host$1 permanent;
    }

    # HTTPS server
    server {
        listen     443;
        rewrite ^(.*) https://$host$1 permanent;
        access_log /var/log/nginx/access.log ssltest;
        error_log /var/log/nginx/error-ssl.log debug;

   ssl on;
   ssl_verify_client on;
   ssl_verify_depth 4;
   ssl_session_cache off;

   proxy_ssl_verify off;
   ssl_prefer_server_ciphers on;
   ssl_ciphers  GOST2012-GOST8912-GOST8912:HIGH;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_certificate /etc/nginx/serverserver.pem;
   ssl_certificate_key engine:gostengy:serverH2H;
   ssl_client_certificate /home/cryptoTEST/CA_bundle.pem;



        location / {
            error_log /var/log/nginx/error.log debug;
            proxy_set_header X-SSL-Client-Cert $ssl_client_cert;
            proxy_set_header X-SSL-client-serial $ssl_client_serial;
            proxy_pass http://10.0.0.85:2534;
            proxy_set_header Host       $host;
            proxy_set_header X-Real-IP $remote_addr;
        }
    }
}