root@b16:/home/kalinin# nginx -V
nginx version: nginx/1.8.0
built by gcc 4.9.2 (Debian 4.9.2-10) 
built with OpenSSL 1.0.1k 8 Jan 2015
TLS SNI support enabled
......

server {
    listen       443 ssl;
    server_name  localhost;

    ssl on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_certificate /home/kalinin/linux-amd64/le-6a1ee.000/xxxxxx.ru.cer;
    ssl_certificate_key engine:gost_capi:xxxxxx.ru;

    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  5m;
    ssl_ciphers  HIGH:MEDIUM:+GOST2001-GOST89;
    ssl_prefer_server_ciphers   on;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

server {
    listen       localhost:443 ssl;
    server_name  localhost;

    ssl on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

    ssl_certificate /home/kalinin/linux-amd64/le-6a1ee.000/xxxxxxx.rsa.crt;
    ssl_certificate_key /home/kalinin/linux-amd64/le-6a1ee.000/xxxxxxx.rsa.key;

    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  5m;
    ssl_ciphers  HIGH:MEDIUM;
    ssl_prefer_server_ciphers   on;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

$ openssl s_client -debug -connect 10.1.1.16:443
CONNECTED(00000003)
write to 0x1cbe4d0 [0x1cbea70] (308 bytes => 308 (0x134))
0000 - 16 03 01 01 2f 01 00 01-2b 03 03 56 0d 40 e0 cf   ..../...+..V.@..
0010 - 9c 54 6e 03 c3 4d 4c d1-a5 6a eb f1 7a ef de df   .Tn..ML..j..z...
0020 - b7 d8 49 cb f7 dd 02 e8-12 47 dc 00 00 92 c0 30   ..I......G.....0
0030 - c0 2c c0 28 c0 24 c0 14-c0 0a 00 a3 00 9f 00 6b   .,.(.$.........k
0040 - 00 6a 00 39 00 38 00 88-00 87 c0 32 c0 2e c0 2a   .j.9.8.....2...*
0050 - c0 26 c0 0f c0 05 00 9d-00 3d 00 35 00 84 c0 12   .&.......=.5....
0060 - c0 08 00 16 00 13 c0 0d-c0 03 00 0a c0 2f c0 2b   ............./.+
0070 - c0 27 c0 23 c0 13 c0 09-00 a2 00 9e 00 67 00 40   .'.#.........g.@
0080 - 00 33 00 32 00 9a 00 99-00 45 00 44 c0 31 c0 2d   .3.2.....E.D.1.-
0090 - c0 29 c0 25 c0 0e c0 04-00 9c 00 3c 00 2f 00 96   .).%.......<./..
00a0 - 00 41 c0 11 c0 07 c0 0c-c0 02 00 05 00 04 00 15   .A..............
00b0 - 00 12 00 09 00 14 00 11-00 08 00 06 00 03 00 ff   ................
00c0 - 02 01 00 00 6f 00 0b 00-04 03 00 01 02 00 0a 00   ....o...........
00d0 - 34 00 32 00 0e 00 0d 00-19 00 0b 00 0c 00 18 00   4.2.............
00e0 - 09 00 0a 00 16 00 17 00-08 00 06 00 07 00 14 00   ................
00f0 - 15 00 04 00 05 00 12 00-13 00 01 00 02 00 03 00   ................
0100 - 0f 00 10 00 11 00 23 00-00 00 0d 00 22 00 20 06   ......#.....". .
0110 - 01 06 02 06 03 05 01 05-02 05 03 04 01 04 02 04   ................
0120 - 03 03 01 03 02 03 03 02-01 02 02 02 03 01 01 00   ................
0130 - 0f 00 01 01                                       ....
read from 0x1cbe4d0 [0x1cc3fd0] (7 bytes => 7 (0x7))
0000 - 15 03 03 00 02 02 28                              ......(
139857074828944:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:749:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 308 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

        listen                      443 ssl;
        server_name                 xxxxxxx;
        
        ssl_certificate             ../cert/xxxxxxx.gost.crt;
        ssl_certificate_key         "engine:gost_capi:xxxxxxx";
        
        ssl_protocols               TLSv1;
        ssl_ciphers                 HIGH:MEDIUM:+GOST2001-GOST89;
        ssl_prefer_server_ciphers   on;

        listen                      127.0.0.1:443 ssl;
        server_name                 xxxxxxx;
        
        ssl_certificate             ../cert/xxxxxxx.rsa.crt;
        ssl_certificate_key         ../cert/xxxxxxx.rsa.key;
        
        ssl_ciphers                 HIGH:MEDIUM;
        ssl_prefer_server_ciphers   on;