TLS cipher incompatibility

After a routine TLS update, rotating the cert and tightening the allowed cipher/protocol list to disable older suites, a subset of clients suddenly fail to connect. The web dashboard and modern mobile apps work; but an older mobile app version, several B2B partner integrations, and some IoT devices now fail at connection setup. Server logs show TLS handshake failures: 'no shared cipher' / 'unsupported protocol' for the failing clients, and no failures for successful ones. Error rate from these client classes went to ~100%; everyone else is unaffected. The change also dropped TLS 1.0/1.1 support. Triage, mitigate, and decide the durable path.