load_module /usr/lib64/nginx/modules/ngx_stream_module.so;
user  nginx;
worker_processes  1;
error_log  /var/log/nginx/error.log;
events {
    worker_connections  100000;
}

stream {
      
    log_format combined_ssl '$remote_addr,$time_local,$ssl_protocol/$ssl_cipher';
    upstream mosquitto {
        server localhost:1883;
    }

    server {
        listen 8883 ssl;
        proxy_pass mosquitto;
	    access_log /var/log/nginx/access.log combined_ssl;
        ssl_certificate server-in.crt;
        ssl_certificate_key server-in.key;
        ssl_client_certificate ca.crt;
        ssl_verify_client      on;
        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	    ssl_prefer_server_ciphers on;
	    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:DHE-DSS-AES128-SHA:DES-CBC3-SHA";
    }
}
