Not sure if the logs a clear on what/when connection is rejected.
I can share a few troubleshooting hints :
1: Check if you are using the setting require_certificate try to set it to no and test again.
2: You can verify that you can connect to our proxy using libssl
This command will produce a detailed report,
if the connection does not work you may need to add the root CA from letsencrypt
(If your Linux OS is a bit old, this will be the case)
You can test with :
3: take a full TCP trace using tcpdump and look at the handshake, you may learn more about the failure/rejection
Hope this will help you, to save some of your hair
Julien