How to Secure a Segment of TCP Tunnel with TLS Using Gost?

I’m trying to create a multi-hop TCP tunnel using 2 Gost app instances, where packets travel from point A → B → C → D, and back.
• A → B: plain TCP
• B → C: needs to be secured using TLS with a certificate
• C → D: plain TCP

Both B and C are running instances of the Gost application, and A & D are my own written applications.
I want to secure only the B → C (and vice versa) segment using TLS with a certificate.

Question:
What is the correct Gost command to run on both B and C to achieve this setup?
Please provide example command lines for both instances.