How can I find out why curl is failing the nginx SSL TCP forward?

As far as I can device, it should be entirely possible to TCP forward SSL traffic, but it's failing for unknown reasons. My nginx config:

load_module /usr/lib/nginx/modules/ngx_stream_module.so;

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
    worker_connections 768;
}

stream {
  server {
    listen 80;
    proxy_pass mediapop.co:80;
  }
  server {
    listen 443;
    proxy_pass mediapop.co:443;
    ssl_preread on;
  }
}

Then on the same server I run:

$ curl -v -H "Host: mediapop.co" https://localhost
* Rebuilt URL to: https://localhost/
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 592 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* gnutls_handshake() failed: Handshake failed
* Closing connection 0
curl: (35) gnutls_handshake() failed: Handshake failed

I can curl https://mediapop.co directly. Meanwhile the port 80 forward works fine. I'm on the latest nginx 1.14.0.