I am having an issue with Windows IIS server and TLS 1.2 handshake. Windows sent Encrypted Handshake Message and the Client sent Encrypted Alert then both sides reset the connection as shown in the picture. I'd like to understand what causes the Encrypted Alert as more data is expected to be sent. Please help :)
The packet capture clearly shows application data from client to server, which means that the initial handshake itself was already successfully done.
The server reacts to the application data with an Encrypted Handshake message. This might be caused by a request in the application data which requires authentication by client certificate, i.e. no global client certificate to access the server but only one for specific path. The following Encrypted Alert might indicate the TLS Shutdown of the client which closes the connection since it does not possess the requested certificate.
That's likely about all you might get as information from the packet capture alone. For more one would need to have a closer lookup at the server and client side setup, application requirements and log messages.