Three high level cases:

TLS server handshake failure (cannot differentiate what part failed, certificate or protocol or version)

mTLS client fail (failed to validate server certificate, etc)

general TLS fail. Server side we can't generate access logs - it never hits HTTP filter.