An old device cannot connect since we tightened TLS.
Check the cipher suite overlap first:
openssl s_client -connect example.com:443 -tls1_2 -servername example.com
The honest answer is often that the device cannot be supported without weakening security for everyone, which is a decision to make explicitly rather than by config drift.
Large responses hang while small ones work.
Classic MTU or path MTU discovery failure, usually with a tunnel in the path. Test by lowering the MTU on one side and retrying; if it fixes it, the real problem is ICMP being blocked somewhere, which is what breaks discovery.
Is there a simpler version that gets most of the benefit?
Yes: do the first step, skip the automation, and revisit in a month. Most of the value is in the first step, and most of the cost is in making it repeatable before you know it is right.