[Request for Help] 1 WAN, 2 LAN Interfaces (different subnets)

#TL;DR On guest network: ping works, curl works against non-https sites, no ssl sites work

Hello! I've been banging my head against this for the last two days and could use any help or suggestions you all might have.

I've set up my network as follows:

    opnsense 
      - WAN (connects to modem in bridge mode, has external IP)
      - em0 LAN (192.168.1.0/24)
      - em1 IoT (192.168.10.0/24)

LAN and IoT are on two different subnets, and each connects to a different physically seperate switches.

##The LAN works properly 100%

##The IoT network behaves strangely. A lot works properly:

1. Devices on the network get DHCP leases correctly e.g.

IP: 192.168.10.4 Router: 192.168.10.1, Subnet Mask 255.255.255.0)

2. ping works fine. I can ping google.com and the hostname resolves and ping works
3. curl works on non https sites. e.g. I can curl http://www.google.com and get a response.

What doesn't work on the IoT network is any kind of SSL

    wget https://google.com -v
    Resolving google.com (google.com)... 172.217.214.113, .....
    Conecting to google.com (google.com)|172.217.214.113|:443... connected
    Unable to establish SSL connection
    

Things I have tried but didn't work:

• Made sure there is a time server, and both the router and the device I am testing with have the correct time.
• Various NAT rules, feels like maybe the outgoing NAT is incorrect? No NAT rules (besides automatic) are currently applied
• setting the WAN interface as a "Far gateway". From the description this seemed likely but had no effect I could tell.

Open to any ideas or suggestions!

Thanks!