ssl handshake failure with backend server

That's a bit unreadable I'd recommend using some wiki tags so the info formats better.

That being said, what is 192.168.111.58? The backend or the virtual IP?

If it's the backend, it would seem to me the backend isn't talking SSL or requires a client certificate. You can add -prexit to your openssl command to see if it wants a client cert.

If it's the virtual IP, then we'd have to know more about your client-ssl profile. You don't get to the server-ssl profile until after client-ssl was successful.