Typically the best way to debug TLS issues is to run osqueryd with

--verbose --tls_dump

and see what you find in the logs