How to configure Stunnel (win) so that there is a non-retrievable certificate on a token ( ru-token/e-token)?

Question

Stunnel

How to configure Stunnel (windows) so that there is a non-retrievable certificate on a token ( ru-token/e-token) ?
I really need help with step-by-step verified actions (including how to make a self-signed certificate and how to write a certificate to a rutoken / etoken).
On Habré , among other things, there are similar articles about configuring stunnel, but in practice the article is old and repeating the steps described in the article, it was not possible to get everything to work as it should. I found many other articles on the web - it also did not work out.
The task is to make a secure tunnel so that the user can issue a ru-token (etc. options), and a portable version of stunnel - but at the same time, so that no one takes possession of the certificate for connection (only the one who has a physical token that could connect to the server).
And another question on stunnel:
In addition to the token, I would like to force the password / login to be requested.