ssl handshake failure with backend server

For what it's worth, the server is sending a FIN right after the client's ClientHello. That would never indicate that the server requires a client certificate as the CertificateRequest message is AFTER the server's ServerHello and Certificate messages. At most the reasons for the server not sending a ServerHello would be (in general order of precedence):

1. No support for the client's preferred protocol version or list of supported ciphers
2. A missing server name indicator (SNI) extension, if the server requires it
3. Some unknown or incorrect TLS extension