# configuration file /etc/opt/cprocsp/cpnginx/cpnginx.conf:
user cpnginx;
worker_processes auto;

error_log /var/log/cpnginx/error.log notice;
pid /var/run/cpnginx.pid;

events {
worker_connections 1024;
}

http {
include /etc/opt/cprocsp/cpnginx/conf.d/*.conf;
}

# configuration file /etc/opt/cprocsp/cpnginx/conf.d/site1.conf:
upstream backend_site1 {
server 192.168.1.1 max_fails=5 fail_timeout=30s;
}

server {
listen 443 sspi proxy_protocol;
server_name site1.ru ;
server_tokens off;

sspi_certificate 0x7C0030F11354CCF1843B3B463C00130030F113;
sspi_protocols TLSv1.2;
sspi_verify_client on;
sspi_client_certificate Trusted-site1;
sspi_client_verify_local_crl_only on;
location / {
proxy_pass http://backend_site1;
proxy_redirect off;
proxy_set_header X-ClientPublic-IP $proxy_protocol_addr;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
}
}

# configuration file /etc/opt/cprocsp/cpnginx/conf.d/site2.conf:
upstream backend_site2 {
least_conn;
keepalive 32;
server 192.168.1.2 max_fails=5 fail_timeout=30s;
}

server {
listen 443 sspi proxy_protocol;
server_name site2.ru ;
server_tokens off;

sspi_certificate 0x7C0030F1078A77B5372C930F4600130030F107;
sspi_protocols TLSv1.2;
sspi_verify_client on;
sspi_client_certificate Trusted-site2;
sspi_client_verify_local_crl_only on;
location / {
proxy_pass http://backend_site2;
proxy_redirect off;
proxy_set_header X-ClientPublic-IP $proxy_protocol_addr;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Forwarded-For $proxy_protocol_addr;
}
}

# configuration file /etc/opt/cprocsp/cpnginx/conf.d/site3.conf:
server {
listen 443 sspi;
server_name *.site3.ru site3.ru;
server_tokens off;

sspi_certificate 0x4E96BF14A00603F3FE0D2FA9;
sspi_protocols TLSv1.2;

location / {
return 200;
}
}

* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* Recv failure: Connection reset by peer
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: Connection reset by peer in connection to site3:443
* closing connection #0
curl: (35) Recv failure: Connection reset by peer