This error indicates that the server has sent an explicit fatal error.

There should therefore be something in the server logs to indicates why the server has chosen to do this.

Try to build with TLS debug turned on, and check for messages exchange between server and iPXE. If server replies with “02 28”, then TLS was unable to negotiate compatible cipher suites between iPXE and your server. Enable something on the server side to show what is supported by iPXE.