The error implies that the TCP connection can be made, so it's not a network error.  The most common reasons that a TLS session can't be established are 1) the server certificate is not trusted by the client (Web Access, in this case) or 2) the two peers can't negotiate parameters like TLS version or (less likely) cipher suite.  This has been cropping up as admins disable TLS 1.1 and below and has been discussed here before.  A Wireshark trace can shed some light on what's going on for both of those, or you can try checking the relevant configuration.