Oh, and SSLv3 enabled because of client firmware using an old stack, something I can do nothing about. Posted at Nginx Forum: https://forum.nginx.org/read.php?2,287081,287084#msg-287084