server {
listen 443 sspi http2;
server_name SERVER;

sspi_certificate 0x01C30310A315DD00324C1DF; # GOST Serial
sspi_certificate 0x01C203138B65010C02526F; #RSA Serial

sspi_protocols TLSv1.2;

location / {
client_max_body_size 2g;
proxy_pass https://SERVER1:443;
proxy_http_version 1.1;
proxy_sspi on;
proxy_ssl_verify on;
proxy_ssl_server_name on;
proxy_ssl_certificate 0x01C30310A315DD00324C1DF;
proxy_ssl_trusted_certificate Root;
proxy_ssl_verify_local_crl_only on;
limit_except GET HEAD POST { deny all; }
}

location /integr/ {
client_max_body_size 2g;
proxy_pass https://SERVER2:7011/;
proxy_redirect default;
proxy_ssl_certificate /opt/cprocsp/cpnginx/client_cert_for_server2.cer;
proxy_ssl_certificate_key /opt/cprocsp/cpnginx/client_cert_for_server2.key;
proxy_ssl_trusted_certificate /opt/cprocsp/cpnginx/client_cert_root.cer;
limit_except GET HEAD POST { deny all; }
}
}