I had the exact same problem. My problem was that there was no default certificate set on the TFS host in case no SNI name was sent in the TLS handshake. Adding the same cert to "All Unassigned" IP-addresses for port 443 as for the hostname of the cert for the port binding solved the problem.
-- You received this message because you are subscribed to the Google Groups "Jenkins Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/69074215-45a0-4bec-926a-570618ac921e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.