Logging of the connection lifetime and negotiated TLS options

[teoring]

The use case is Common Criteria certification. They require application to log following information for every TCP connection:

source host - destination host:port
TLS protocol
TLS cipher
connection initiation | termination | failure (with reason)

I went over available callbacks and "debug" options and didn't find a way to achieve this. I realize I can force specific cipher or signature algorithm in the configuration but Common Criteria requires logging based on the SSL* context of the connection.

Any advice?