This started after this month's Windows Update, which introduced changes to SSL due to a severe vulnerability.

Microsoft broke it. Disabling Cloudflare for the moment.

Cloudflare tells me other users with Windows Server are reporting the same problem and they're investigating.

We currently have Cloudflare disabled until it is ok to use it again.

We are back on Cloudflare.

Their investigation shows that Windows Servers with the latest update (the one to fix the SSL vulnerability) closed connections for TLSv1.2, UNLESS the cipher used is "ECDHE-RSA-AES256-SHA384". The server will accept other ciphers, but just to close the connection, rather than falling back to TLSv1.0.

They have updated our account to make that the top of the list and if all works well will roll up the change to all domains in their network.