использовал для установки файл install_nginx.sh с дополнительным включением модуля nginx-lua-module при компиляции
сертификаты генерировал самостоятельно по инструкции, заменив только CN и storage

openssl engine
(rdrand) Intel RDRAND engine
(dynamic) Dynamic engine loading support
(gostengy) CryptoPro GostEngy ($Revision: 180423 $)


nginx -V
nginx version: nginx/1.13.6
built by gcc 7.3.0 (Ubuntu 7.3.0-27ubuntu1~18.04)
built with OpenSSL 1.1.0g 2 Nov 2017 (running with OpenSSL 1.1.0h 27 Mar 2018)
TLS SNI support enabled
configure arguments: --prefix=/etc/nginx --with-ld-opt=-Wl,-rpath,/usr/local/lib --add-module=/tmp/nginx-lu/ngx_devel_kit-0.3.0 --add-module=/tmp/nginx-lu/lua-nginx-module-0.10.13 --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --user=root --group=www-data --user=www-data --group=www-data --with-compat --with-file-aio --with-threads --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --with-http_v2_module --with-mail --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-cc-opt='-g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC' --with-ld-opt='-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie'

вот конфиг nginx

server
{
access_log /var/log/nginx/default.access.log;
error_log /var/log/nginx/default.error.log debug;
keepalive_timeout 120;

listen 443 ssl http2 default reuseport;
real_ip_header proxy_protocol;
proxy_set_header Host $host:$server_port;

# Redirect HTTP to HTTPS
if ($scheme = http)
{
return 301 https://$host$request_uri;
}

# return 301 https://$host$request_uri;

# SSL configuration
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers GOST2012-GOST8912-GOST8912:GOST2001-GOST89-GOST89:HIGH;
ssl_prefer_server_ciphers on;

ssl_session_cache shared:SSL:128m;
ssl_session_timeout 1h;
ssl_session_tickets off;
ssl_buffer_size 4k;


#Первый сертификат в файле РСА потом ГОСТ
ssl_client_certificate /etc/certs/ca-bundle.pem;
ssl_verify_client on;


ssl_certificate_key engine:gostengy:mtravel;
ssl_certificate /etc/certs/server/gost/crt.pem;

ssl_certificate /etc/certs/server/rsa/crt.pem;
ssl_certificate_key /etc/certs/server/rsa/key.pem;
server_name meteotravel.ru;



root /var/www/html;

index index.html index.htm index.nginx-debian.html;


location /fop1
{
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.


# Add index.php to the list if you are using PHP
try_files $uri $uri/ =404;
}
}