Send SOCKS proxy credentials over SSL/TLS

OpenVPN client config file has a socks-proxy rule which allows connecting to a SOCKS proxy before connecting to a VPN. I installed Dante SOCKS proxy but it looks like it does not support SSL/TLS so credentials will be sent in clear text and someone on the same local network could do a man-in-the-middle attack by sniffing the network and see the credentials (https://security.stackexchange.com/questions/183146/are-socks5-credentials-safe-during-authentication-on-proxy-server).

Isn't it possible to add SSL/TLS support to Dante SOCKS proxy like it can be done with an FTP server?

If it is not possible officially, I think we need to use stunnel to create an SSL/TLS tunnel. But since the VPN only allows connections through UDP, I think we also need to use udptunnel (https://manpages.ubuntu.com/manpages/xenial/man1/udptunnel.1.html) because stunnel and SSL/TLS only work with TCP (https://www.stunnel.org/faq.html).

Here is my Dante SOCKS proxy configuration file /etc/sockd.conf on my VPS Linux server:

internal: venet0:0 port = 8088
external: venet0:0
socksmethod: username #none #rfc931
clientmethod: none
user.privileged: root
user.notprivileged: nobody
user.libwrap: nobody
client pass {
        from: 0.0.0.0/0 to: 0.0.0.0/0
        log: connect disconnect error
}                                                                                                                                                                                             
socks pass {                                                                                                                                                                                  
        from: 0.0.0.0/0 to: 0.0.0.0/0                                                                                                                                                         
        protocol: tcp udp                                                                                                                                                                     
}

After starting sockd Dante SOCKS proxy, I start udptunnel on the same server, which should connect to the proxy:

udptunnel -s 8080 127.0.0.1:8088

Then I start stunnel on the same server, which should connect to udptunnel, with this configuration file /etc/stunnel/stunnel.conf:

client = no
[udptunnel]
accept = 8888
connect = 127.0.0.1:8080
cert = /etc/stunnel/stunnel.pem

And then I connect using OpenVPN on my computer, with this rule in the client config file:

socks-proxy PROXY_IP_ADDRESS 8888 stdin

However I did not get it working. I can only connect to the proxy and VPN if I am sending proxy credentials in clear text, which is not secure. Currently if I want to connect securely from a different IP address to a VPN, I have to connect from another VPN before connecting to the VPN, which works great but I would be interested to know if it is possible using a SOCKS proxy with SSL/TLS.