Fixed by changing server as noted above.

Thanks for all the help @gniibe.

It should not be removed as I believe it is required to be compliant:

Server is nginx with the following settings

Thanks for taking time to look into this. You have clearly identified the issue.

After the original fail - one of the things I tried was changing nginx server to allow TLSv1.2:

Thank you again.

Excellent thank you.

okidok - understand and thank you.