I think you're right. Unfortunately I don't have access to the server to apply changes there. I did track it down to TLS handshaking, the server sends a RST when it can't negotiate a cipher suite.
I'm investigating other workarounds at the moment, perhaps cutting the problematic server out of the loop.