io@ubuntu2:~$ sudo -u www-data openssl s_server -engine gost_capi -CAfile /home/io/share/certnew.cer -keyform ENGINE -key test.innovacia.ru -cert /home/io/share/test5.cer
engine "gost_capi" set.
Using default temp DH parameters
ACCEPT
-----BEGIN SSL SESSION PARAMETERS-----
MGoCAQECAgMDBAIAgQQABDAm8VN/ukT6IrOektRKACYb6Z8s94zibdaRZJU/pNHU
h/v54Lx633kYe4EZRKBj/eShBgIEWZzzGaIEAgIBLKQGBAQBAAAAphMEEXRlc3Qu
aW5ub3ZhY2lhLnJ1
-----END SSL SESSION PARAMETERS-----
Shared ciphers:GOST2001-GOST89-GOST89:DHE-DSS-AES128-SHA:DH-RSA-AES128-SHA
Signature Algorithms: 0xEE+0xEE:0xEF+0xEF:0xED+md_gost94
Shared Signature Algorithms: 0xED+md_gost94
CIPHER is GOST2001-GOST89-GOST89
Secure Renegotiation IS supported
GET / HTTP/1.1
User-Agent: Webclient
Accept:*/*
Host: test.innovacia.ru
Connection: close

io@ubuntu2:~$ /opt/cprocsp/bin/amd64/csptestf -tlsc -server test.innovacia.ru -port 4433 -v
8 algorithms supported:
[0] 1.2.643.2.2.21 (ГОСТ 28147-89)
[1] 1.2.643.2.2.3 (ГОСТ Р 34.11/34.10-2001)
[2] 1.2.643.7.1.1.2.2 (ГОСТ Р 34.11-2012 256 bit)
[3] 0x801f
[4] 1.2.643.2.2.20 (ГОСТ Р 34.10-94)
[5] 1.2.643.2.2.19 (ГОСТ Р 34.10-2001)
[6] 1.2.643.7.1.1.1.1 (ГОСТ Р 34.10-2012)
[7] 1.2.643.7.1.1.1.2 (ГОСТ Р 34.10-2012)
Cipher strengths: 256..256
Supported protocols: 0x80
dwProtocolMask: 0x800a0aaa
Protocol version: 3.3
ClientHello: RecordLayer: TLS, Len: 100
Cipher Suites: (ff 85) (00 81) (00 32) (00 31)
105 bytes of handshake data sent
1588 bytes of handshake data received
210 bytes of handshake data sent
222 bytes of handshake data received
Handshake was successful
SECPKG_ATTR_CIPHER_INFO: Protocol: 800, Suite: 81 (TLS_GOSTR341001_WITH_28147_CNT_IMIT)
SECPKG_ATTR_CIPHER_INFO: Cipher: (GOST 28147-89), Len: 256, BlockLen: 1
SECPKG_ATTR_CIPHER_INFO: Hash: (GOST R 34.11-94), Len: 256
SECPKG_ATTR_CIPHER_INFO: Exchange: (GOST DH 34.10-2001), MinLen: 512, MaxLen: 512
SECPKG_ATTR_CIPHER_INFO: Certificate: (GR 34.10-2001), KeyType: 0
SECPKG_ATTR_NAMES: E=iochagov@innovacia.ru, CN=test.innovacia.ru, OU=IT, O=TransportTv, L=To                                                                                     msk, S=Tomsk oblast, C=RU
SECPKG_ATTR_PACKAGE_INFO not supported.

Server certificate:
Subject: E=iochagov@innovacia.ru, CN=test.innovacia.ru, OU=IT, O=TransportTv, L=Tomsk, S=Tom                                                                                     sk oblast, C=RU
Valid  : 22.08.2017 09:57:48 - 22.11.2017 10:07:48 (UTC)
Issuer : E=support@cryptopro.ru, C=RU, L=Moscow, O=CRYPTO-PRO LLC, CN=CRYPTO-PRO Test Center                                                                                      2

Protocol: TLS 1.2
Cipher: 0x661e
Cipher strength: 256
Hash: 0x801e
Hash strength: 256
Key exchange: 0xaa25
Key exchange strength: 512

Header: 5, Trailer: 4, MaxMessage: 16384

HTTP request: GET / HTTP/1.1
User-Agent: Webclient
Accept:*/*
Host: test.innovacia.ru
Connection: close


Sending plaintext: 97 bytes
115 bytes of application data sent

io@ubuntu2:~$ /opt/cprocsp/bin/amd64/csptestf -tlsc -server test.innovacia.ru -port 443 -v
8 algorithms supported:
[0] 1.2.643.2.2.21 (ГОСТ 28147-89)
[1] 1.2.643.2.2.3 (ГОСТ Р 34.11/34.10-2001)
[2] 1.2.643.7.1.1.2.2 (ГОСТ Р 34.11-2012 256 bit)
[3] 0x801f
[4] 1.2.643.2.2.20 (ГОСТ Р 34.10-94)
[5] 1.2.643.2.2.19 (ГОСТ Р 34.10-2001)
[6] 1.2.643.7.1.1.1.1 (ГОСТ Р 34.10-2012)
[7] 1.2.643.7.1.1.1.2 (ГОСТ Р 34.10-2012)
Cipher strengths: 256..256
Supported protocols: 0x80
dwProtocolMask: 0x800a0aaa
Protocol version: 3.3
ClientHello: RecordLayer: TLS, Len: 100
Cipher Suites: (ff 85) (00 81) (00 32) (00 31)
105 bytes of handshake data sent
7 bytes of handshake data received
**** Error 0xffffffff80090304 returned by InitializeSecurityContext (2)
An error occurred in running the program.
/dailybuildsbranches/CSP_4_0/CSPbuild/CSP/samples/csptest/WebClient.c:578:Error performing handshake.
Error number 0x80090304 (2148074244).
The Local Security Authority cannot be contacted
Total: SYS: 0.000 sec USR: 0.040 sec UTC: 0.050 sec
[ErrorCode: 0x80090304]

2017/08/23 10:18:32 [crit] 9775#9775: *1 SSL_do_handshake() failed (SSL: error:8006A063:lib(128):CAPI_INIT:cant create hash object error:14125044:SSL routines:ssl3_digest_cached_records:internal error) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:443

io@ubuntu2:~$ cat /etc/nginx/sites-enabled/ssl
# HTTPS server
server {
    ssl on;
    listen      443 ssl;
    server_name  test.innovacia.ru;

    ssl_certificate      /etc/nginx/cert.cer;
    ssl_certificate_key  engine:gost_capi:test.innovacia.ru;
    ssl_session_cache shared:SSL:1m;
    ssl_session_timeout  5m;
    ssl_protocols  TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers  HIGH:MEDIUM:+GOST2001-GOST89;
    ssl_prefer_server_ciphers   on;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }
}

io@ubuntu2:~$ nginx -V
nginx: /opt/cprocsp/cp-openssl/lib/amd64/libcrypto.so.1.0.0: no version information available (required by nginx)
nginx: /opt/cprocsp/cp-openssl/lib/amd64/libcrypto.so.1.0.0: no version information available (required by nginx)
nginx: /opt/cprocsp/cp-openssl/lib/amd64/libssl.so.1.0.0: no version information available (required by nginx)
nginx: /opt/cprocsp/cp-openssl/lib/amd64/libssl.so.1.0.0: no version information available (required by nginx)
nginx: /opt/cprocsp/cp-openssl/lib/amd64/libssl.so.1.0.0: no version information available (required by nginx)
nginx version: nginx/1.10.3 (Ubuntu)
built with OpenSSL 1.0.2g  1 Mar 2016 (running with OpenSSL 1.0.2j  26 Sep 2016)
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fdebug-prefix-map=/build/nginx-aIL3tz/nginx-1.10.3=. -fPIE -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -fPIE -pie -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-debug --with-pcre-jit --with-ipv6 --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --with-http_addition_module --with-http_geoip_module=dynamic --with-http_gunzip_module --with-http_gzip_static_module --with-http_image_filter_module=dynamic --with-http_sub_module --with-http_xslt_module=dynamic --with-stream=dynamic --with-stream_ssl_module --with-mail=dynamic --with-mail_ssl_module

io@ubuntu2:~$ cat /var/opt/cprocsp/tmp/gost_capi.log
366C5EC7:0002 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
366C5EC7:0003 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0002 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0003 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0004 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0005 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0006 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0007 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
B22F3012:0008 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
C1416E56:0002 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
9289415B:0002 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719
7AFA2AB3:0002 (ngg_hash_init_common:974) ERROR: CryptCreateHash = 0x00002719