yes client issue. I expect, actually its a driver issue...and if you do something horrible like enable FIPS mode on the client (so all the encryption is done in software via CPU rather than by NIC in hardware via driver) it'll work :(
Unfortunately FIPS did not help, neither did the registry hack in [3] above. There is a bug somewhere in the Windows/Intel driver mix, but I'm not going to waste any more of my time trying to solve their standards (in)compliance.
When I create certificates, I use "conservative" values. RSA, 2048 bit keys, SHA, etc. That works everywhere. The more "odd" things you use, the less likely it is to work.
I tend to try the strongest values I can get to work, and in this case a server key using secp384r1 will still work while I need to support Windows clients. But then again maybe that's why I keep having odd things go wrong that Google can't help solve ;) Thanks everyone for your help Marty