sudo apt-get update && sudo apt-get install -y nginx lsb-core
Скачал КриптоПро CSP 4.0 R3 (исполнения 1-Base/2-Base и 1-Lic/2-Lic).
Распаковал.
cd linux-amd64_deb/
sudo linux-amd64_deb/install.sh
sudo /opt/cprocsp/sbin/amd64/cpconfig -hardware reader -add HDIMAGE store
wget https://raw.githubusercontent.com/fullincome/scripts/master/nginx-gost/install-certs.sh
chmod +x ./install-certs.sh 
sudo dpkg -i cprocsp-cpopenssl-base_4.0.9944-5_all.deb 
sudo dpkg -i cprocsp-cpopenssl-64_4.0.9944-5_amd64.deb 
sudo dpkg -i cprocsp-cpopenssl-gost-64_4.0.9944-5_amd64.deb 
sudo dpkg -i lsb-cprocsp-kc2-64_4.0.9944-5_amd64
sudo mcedit /usr/lib/ssl/openssl.cnf
openssl engine

cat /usr/lib/ssl/openssl.cnf
#
# OpenSSL example configuration file.
# This is mostly being used for generation of certificate requests.
#

# This definition stops the following lines choking if HOME isn't
# defined.
HOME        = .
RANDFILE    = $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:
#oid_file      = $ENV::HOME/.oid
oid_section    = new_oids

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
gost_capi = gost_section

[gost_section]
engine_id = gost_capi
dynamic_path = /opt/cprocsp/cp-openssl/lib/amd64/engines/libgost_capi.so
default_algorithms = CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1

(dynamic) Dynamic engine loading support
139812756447680:error:260B6091:engine routines:dynamic_load:version incompatibility:../crypto/engine/eng_dyn.c:454:
139812756447680:error:260BC066:engine routines:int_engine_configure:engine configuration error:../crypto/engine/eng_cnf.c:141:section=gost_section, name=dynamic_path, value=/opt/cprocsp/cp-openssl/lib/amd64/engines/libgost_capi.so
139812756447680:error:0E07606D:configuration file routines:module_run:module initialization error:../crypto/conf/conf_mod.c:173:module=engines, value=engine_section, retcode=-1  

Для OpenSSL >= 1.1.0 поддерживаются версии TLS до 1.2 (рекомендуем использовать openssl-1.1.0-gost)