CentOS Linux release 7.4.1708 (Core) 

yum install -y wget curl-devel
yum install -y lsb-cprocsp-base
yum install -y lsb-cprocsp-rdr-64
yum install -y lsb-cprocsp-capilite-64
yum install -y lsb-cprocsp-kc1-64
yum install -y lsb-cprocsp-kc2-64
yum install -y cprocsp-curl-64
yum install -y cprocsp-cpopenssl-gost-64
yum install -y cprocsp-cpopenssl-devel

yum provides /opt/cprocsp/cp-openssl/include
Loaded plugins: fastestmirror, fusioninventory-agent
Loading mirror speeds from cached hostfile
cprocsp-cpopenssl-devel-5.0.10874-5.noarch : Openssl devel Build 10874.
Repo        : cryptopro_client_repo_5
Matched from:
Filename    : /opt/cprocsp/cp-openssl/include

Installed Packages
cprocsp-cpopenssl-base.noarch     5.0.10874-5
cprocsp-cpopenssl-devel.noarch    5.0.10874-5
cprocsp-cpopenssl-gost-64.x86_64  5.0.10874-5
cprocsp-curl-64.x86_64            5.0.10874-5
lsb-cprocsp-base.noarch           5.0.10874-5
lsb-cprocsp-capilite-64.x86_64    5.0.10874-5
lsb-cprocsp-kc1-64.x86_64         5.0.10874-5
lsb-cprocsp-kc2-64.x86_64         5.0.10874-5
lsb-cprocsp-rdr-64.x86_64         5.0.10874-5

openssl_conf = openssl_def

[openssl_def]
engines = engine_section

[engine_section]
gost_capi = gost_section

[gost_section]
engine_id = gost_capi
dynamic_path = /opt/cprocsp/cp-openssl/lib/amd64/engines/libgost_capi.so
default_algorithms = CIPHERS, DIGESTS, PKEY, PKEY_CRYPTO, PKEY_ASN1

ldd /opt/cprocsp/cp-openssl/lib/amd64/engines/libgost_capi.so.0.0.0  |grep not
ldd: warning: you do not have execution permission for `/opt/cprocsp/cp-openssl/lib/amd64/engines/libgost_capi.so.0.0.0'
	libcrypto.so.1.0.0 => not found

ln -s /usr/lib64/libcrypto.so.10 /usr/lib64/libcrypto.so.1.0.0
/sbin/ldconfig /usr/lib64

openssl engine
(rdrand) Intel RDRAND engine
(dynamic) Dynamic engine loading support
(gost_capi) CryptoPro ENGINE GOST CAPI ($Revision: 163536 $)

/opt/cprocsp/bin/amd64/cryptcp -creatcert -provtype 81 -provname 'Crypto-Pro GOST R 34.10-2012 KC1 Strong CSP' -rdn 'CN=srvtest' -cont '\\.\HDIMAGE\srvtest' -certusage 1.3.6.1.5.5.7.3.1 -ku -du -ex -ca http://cryptopro.ru/certsrv
CryptCP 5.0 (c) "Crypto-Pro", 2002-2017.
Command prompt Utility for file signature and encryption.
Creating request...
Press keys...
[....................................................................................................................................................................................................]

Crypto-Pro GOST R 34.10-2012 KC1 Strong CSP requests new authentication properties for container
password:
Retype password
password:
Sending request to CA...
Installing certificate...
Message contains root certificate that is absent in your root store.
RDN:CRYPTO-PRO Test Center 2, CRYPTO-PRO LLC, Moscow, RU, support@cryptopro.ru
Valid from 05.08.2014 13:44:24 to 05.08.2019 13:54:03

Do you want to add it to Root store? [Y]es or [N]o: Y
Adding certificate to Root store.
Authentication in container. Crypto-Pro GOST R 34.10-2012 KC1 Strong CSP requests password
password:
Certificate is installed.
[ErrorCode: 0x00000000]

/opt/cprocsp/bin/amd64/certmgr -inst -store uMy -cont '\\.\HDIMAGE\srvtest' -provtype 75 -provname "Crypto-Pro GOST R 34.10-2001 KC2 CSP" || exit 1
Certmgr 1.0 (c) "CryptoPro",  2007-2016.
program for managing certificates, CRLs and stores

Install:
=============================================================================
1-------
Issuer              : E=support@cryptopro.ru, C=RU, L=Moscow, O=CRYPTO-PRO LLC, CN=CRYPTO-PRO Test Center 2
Subject             : CN=srvtest
Serial              : 0x120022717BA14B7BFECC5980DF00000022717B
SHA1 Hash           : b2ebd5edb169749e927bd54b5b4395340abcdb13
SubjKeyID           : 69f11578295477d8f2f73d1d96329ad43045b809
Signature Algorithm : ГОСТ Р 34.11/34.10-2001
PublicKey Algorithm : ГОСТ Р 34.10-2012 (1024 bits)
Not valid before    : 09/11/2017  11:44:38 UTC
Not valid after     : 09/02/2018  11:54:38 UTC
PrivateKey Link     : No                  
CA cert URL         : http://testca.cryptopro.ru/CertEnroll/test-ca-2014_CRYPTO-PRO%20Test%20Center%202.crt
OCSP URL            : http://testca.cryptopro.ru/ocsp/ocsp.srf
CDP                 : http://testca.cryptopro.ru/CertEnroll/CRYPTO-PRO%20Test%20Center%202.crl
Extended Key Usage  : 1.3.6.1.5.5.7.3.1
=============================================================================

[ErrorCode: 0x00000000]

/opt/cprocsp/bin/amd64/certmgr -export -cert -dn "CN=srvtest" -dest '/etc/nginx/srvtest.cer' || exit 1
Certmgr 1.0 (c) "CryptoPro",  2007-2016.
program for managing certificates, CRLs and stores

Exporting: 
=============================================================================
1-------
Issuer              : E=support@cryptopro.ru, C=RU, L=Moscow, O=CRYPTO-PRO LLC, CN=CRYPTO-PRO Test Center 2
Subject             : CN=srvtest
Serial              : 0x120022717BA14B7BFECC5980DF00000022717B
SHA1 Hash           : b2ebd5edb169749e927bd54b5b4395340abcdb13
SubjKeyID           : 69f11578295477d8f2f73d1d96329ad43045b809
Signature Algorithm : ГОСТ Р 34.11/34.10-2001
PublicKey Algorithm : ГОСТ Р 34.10-2012 (1024 bits)
Not valid before    : 09/11/2017  11:44:38 UTC
Not valid after     : 09/02/2018  11:54:38 UTC
PrivateKey Link     : Yes                 
Container           : HDIMAGE\\srvtest.000\AF26
Provider Name       : Crypto-Pro GOST R 34.10-2001 KC2 CSP
Provider Info       : ProvType: 75, KeySpec: 1, Flags: 0x0
CA cert URL         : http://testca.cryptopro.ru/CertEnroll/test-ca-2014_CRYPTO-PRO%20Test%20Center%202.crt
OCSP URL            : http://testca.cryptopro.ru/ocsp/ocsp.srf
CDP                 : http://testca.cryptopro.ru/CertEnroll/CRYPTO-PRO%20Test%20Center%202.crl
Extended Key Usage  : 1.3.6.1.5.5.7.3.1
=============================================================================
Export complete

[ErrorCode: 0x00000000]

openssl x509 -inform DER -in "/etc/nginx/srvtest.cer" -out "/etc/nginx/srvtest.pem" || exit 1

openssl req -x509 -newkey rsa:2048 -keyout /etc/nginx/srvtestRSA.key -nodes -out /etc/nginx/srvtestRSA.pem -subj '/CN=srvtestRSA/C=RU' || exit 1
Generating a 2048 bit RSA private key
.............+++
........+++
writing new private key to '/etc/nginx/srvtestRSA.key'
-----

openssl rsa -in /etc/nginx/srvtestRSA.key -out /etc/nginx/srvtestRSA.key
writing RSA key

rm -f /etc/nginx/conf.d/default.conf

user  root;
worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;
    keepalive_timeout  65;

    server {
        listen       443 ssl;
        server_name  srvtest;

        ssl_certificate      /etc/nginx/srvtest.pem;
        ssl_certificate_key  engine:gostengy:srvtest;
        ssl_certificate      srvtestRSA.pem;
        ssl_certificate_key  srvtestRSA.key;
        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers GOST2012-GOST8912-GOST8912:GOST2001-GOST89-GOST89:HIGH;
        ssl_prefer_server_ciphers  on;

        location / {
            root   html;
            index  index.html index.htm;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

nginx
nginx: [emerg] SSL_CTX_use_certificate("/etc/nginx/srvtest.pem") failed (SSL: error:0609E09C:digital envelope routines:PKEY_SET_TYPE:unsupported algorithm error:0B07706F:x509 certificate routines:X509_PUBKEY_get:unsupported algorithm error:140BF10C:SSL routines:SSL_SET_CERT:x509 lib)