Agent: TLS connection closed during handshake SSL_shutdown with returned error code 5

[t-readyroc]

Ubuntu 14.04
Zabbix 3.4.6

Agent logs (on the server, no less) are flooded with:

  1834:20180517:203944.235 failed to accept an incoming connection: from 10.0.0.73: TLS connection has been closed during handshake::
  1833:20180517:203958.224 SSL_shutdown() with 10.0.0.73 returned error code 5:

(Server is 10.0.0.73)

Agent config:

#
PidFile=/var/run/zabbix/zabbix_agentd.pid
LogFile=/var/log/zabbix/zabbix_agentd.log
LogFileSize=0
Server=10.0.0.73
ServerActive=10.0.0.73
Include=/etc/zabbix/zabbix_agentd.d/
EnableRemoteCommands=1
UnsafeUserParameters=1
#
# Discovery
UserParameter=custom.vfs.dev.discovery,/usr/bin/detect-mounted-disks
#
# NTP
UserParameter=ntp.stratumcheck,ntpdc -c sysinfo | grep stratum | cut -f2 -d':' |  tr -d '[[:space:]]'
#
# NFS
#
UserParameter=nfs.mount_ok[*],timeout -s 9 10 stat -f -c '%T' '$1'  || echo STALE
#
# Disk
UserParameter=custom.vfs.dev.read.ops[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$4}'
UserParameter=custom.vfs.dev.read.ms[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$7}'
UserParameter=custom.vfs.dev.write.ops[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$8}'
UserParameter=custom.vfs.dev.write.ms[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$11}'
UserParameter=custom.vfs.dev.io.active[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$12}'
UserParameter=custom.vfs.dev.io.ms[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$13}'
UserParameter=custom.vfs.dev.read.sectors[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$6}'
UserParameter=custom.vfs.dev.write.sectors[*],cat /proc/diskstats | egrep $1 | head -1 | awk '{print $$10}'
#
# Encryption
TLSConnect=psk
TLSAccept=psk
TLSPSKFile=/etc/zabbix/zabbix_agentd.psk
TLSPSKIdentity=PSK 001

Some (I think) corresponding entries from the server.log:

2115:20180517:204353.187 Zabbix agent item "vfs.fs.size[/hostedftp-temp,free]" on host "10.0.0.73" failed: another network error, wait for 15 seconds
2115:20180517:204411.204 Zabbix agent item "system.cpu.util[,iowait]" on host "10.0.0.73" failed: another network error, wait for 15 seconds
2114:20180517:204429.211 temporarily disabling Zabbix agent checks on host "10.0.0.73": host unavailable

The result is a flapping agent (& associated notifications). We're seeing this on multiple hosts; not just the server agent.