Log SSL handshake failure reason as well as Client IP in nginx - ssl

Question

I have an nginx.conf configuration file that looks like this:
user vagrant;
worker_processes auto;
error_log /var/log/nginx/error.log debug;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 1024;
# multi_accept on;
}
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
# server_tokens off;
# server_names_hash_bucket_size 64;
# server_name_in_redirect off;
# defining log format
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$ssl_protocol '
'$status $body_bytes_sent "$host" "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
include /etc/nginx/mime.types;
default_type application/octet-stream;
##
# SSL Settings
##
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
ssl_prefer_server_ciphers on;
##
# Logging Settings
##
access_log /var/log/nginx/access.log main;
##
# Gzip Settings
##
gzip on;
# gzip_vary on;
# gzip_proxied any;
# gzip_comp_level 6;
# gzip_buffers 16 8k;
# gzip_http_version 1.1;
# gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
##
# Virtual Host Configs
##
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
and my individual server configuration that looks like this:
server {
# listen on port 443 (https)
listen 443 ssl;
server_name www.domain.org domain.org;
# location of the self-signed SSL certificate
ssl_certificate /home/vagrant/certs/domain.org.crt;
ssl_certificate_key /home/vagrant/domain.org.key;
#log SSL errors
error_log /var/log/nginx/error_tls_2.log debug;
location / {
# forward application requests to the gunicorn server
proxy_pass http://localhost:8000;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
I want to be able to log SSL handshake failure errors with a specific requests Client IP as well as the reason for SSL handshake failure. More specifically, I am testing the kind of error received when the server certificate is out of date. However, in the log file where I am logging the error, the log format is of this form:
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN supported by client: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL ALPN selected: http/1.1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL handshake handler: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_do_handshake: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL: TLSv1.2, cipher: "ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD"
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: -1
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 2
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 http wait request handler
2019/04/11 22:43:02 [debug] 3086#3086: *27 malloc: 00005640A0AF45C0:1024
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_read: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_get_error: 5
2019/04/11 22:43:02 [debug] 3086#3086: *27 peer shutdown SSL cleanly
2019/04/11 22:43:02 [info] 3086#3086: *27 client closed connection while waiting for request, client: 192.168.33.1, server: 0.0.0.0:443
2019/04/11 22:43:02 [debug] 3086#3086: *27 close http connection: 4
2019/04/11 22:43:02 [debug] 3086#3086: *27 SSL_shutdown: 1
2019/04/11 22:43:02 [debug] 3086#3086: *27 event timer del: 4: 2302465
2019/04/11 22:43:02 [debug] 3086#3086: *27 reusable connection: 0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0AF45C0
2019/04/11 22:43:02 [debug] 3086#3086: *27 free: 00005640A0A855C0, unused: 24
As can be seen none of these lines allow me to distinguish the Client's IP or the reason for SSL handshake failure. Could anyone help with how can I do this?