Found my answer. Looked in the liagent log and discovered it was attempting to use SSL but had no cert.
2019-10-14 12:17:09.421626 0x00007fb040ff9700 <error> CurlConnection:723 | Transport error while trying to connect to '***.***.***.***': SSL connect error
2019-10-14 12:17:09.421679 0x00007fb040ff9700 <trace> CFApiTransport:108 | Postponing connection to ***.***.***.***:9000 by 80 sec.
2019-10-14 12:18:29.421774 0x00007fb040ff9700 <trace> CFApiTransport:128 | Re-connecting to server ***.***.***.***:9000
Should have looked there before the post-- but hey, maybe this might help someone else some day.