Azure IoTHub rejects new devices: azure_iot_hub: Failed to connect MQTT client, error: -111

Question

My set of new devices are unable to connect to the IoTHub.

We have quite a number of existing devices connecting ok, this is new (factory) devices, with new certificates.

If I try a new device configured with one of the old (existing) certificates it connects fine, so probably the culprit is the new certificates.
However, this process is scripted, and should be done exactly the same way as last time.
I cannot see any errors in the AzureDiagnostics logs indicating this error.

Please, where/how should I search for the 111 "Connection refused" error details in the logs?
I'm using this query (returning no rows):

AzureDiagnostics
| where ResultType == "Failure"
| project TimeGenerated, OperationName, ResultType, ResultDescription