Forticlient sslvnp "vpn server not reachable" for all Andorid/chrome devices.

Starting today, all of our devices that use the android forticlient VPN app will not connect, they generate a generic "VPN server not reachable" error and the email alert states "reason="sslvpn_login_permission_denied" msg="SSL user failed to logged in". You can log in to the web client from the device in question, and all of our windows devices are working fine with the forticlient app. The only thing that has changed recently is the move to 6.4.11 a few weeks ago due to the announced exploits. From what I can tell the app hasn't been updated since August so I don't think anything changed there, Anyone else has SSL VPN issues with 6.4.11? I am going to reboot the FW after hours and see if that changes anything.

debug from the device is below. The red text looks to be the error.

FG100E # [231:root:263]allocSSLConn:298 sconn 0x34557200 (0:root)
[231:root:263]SSL state:before SSL initialization (174.x.x.60)
[231:root:263]SSL state:before SSL initialization (174.x.x.60)
[231:root:263]got SNI server name: 50.x.x.214 realm (null)
[231:root:263]client cert requirement: no
[231:root:263]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write server hello (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write change cipher spec (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data:system lib(174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data (174.x.x.60)
[231:root:263]got SNI server name: 50.x.x.214 realm (null)
[231:root:263]client cert requirement: no
[231:root:263]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write server hello (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 write encrypted extensions (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write certificate (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 write server certificate verify (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write finished (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data (174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data:system lib(174.x.x.60)
[231:root:263]SSL state:TLSv1.3 early data (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS read finished (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write session ticket (174.x.x.60)
[231:root:263]SSL state:SSLv3/TLS write session ticket (174.x.x.60)
[231:root:263]SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384
[231:root:263]req: /remote/info?lang=en
[231:root:263]capability flags: 0xdf
[231:root:263]req: /remote/login?lang=en
[231:root:263]rmt_web_auth_info_parser_common:465 no session id in auth info
[231:root:263]rmt_web_get_access_cache:807 invalid cache, ret=4103
[231:root:263]User Agent: FortiSSLVPN (Android; SV1 [SV{v=02.01; f=04;}])
[231:root:263]get_cust_page:127 saml_info 0
[231:root:263]req: /remote/logincheck
[231:root:263]rmt_web_auth_info_parser_common:465 no session id in auth info
[231:root:263]rmt_web_access_check:726 access failed, uri=[/remote/logincheck],ret=4103,
[231:root:263]User Agent: FortiSSLVPN (Android; SV1 [SV{v=02.01; f=04;}])
[231:root:263]rmt_logincheck_cb_handler:1255 user 't****Y' has a matched local entry.
[231:root:263]sslvpn_auth_check_usrgroup:2657 forming user/group list from policy.
[231:root:263]sslvpn_auth_check_usrgroup:2695 got user (0) group (1:0).
[231:root:263]sslvpn_validate_user_group_list:1803 validating with SSL VPN authentication rules (1), realm ().
[231:root:263]sslvpn_validate_user_group_list:1923 checking rule 1 cipher.
[231:root:263]sslvpn_validate_user_group_list:1931 checking rule 1 realm.
[231:root:263]sslvpn_validate_user_group_list:1942 checking rule 1 source intf.
[231:root:263]sslvpn_validate_user_group_list:1981 checking rule 1 vd source intf.
[231:root:263]sslvpn_validate_user_group_list:2262 rule 1 done, got user (0:0) group (1:0) peer group (0).
[231:root:263]sslvpn_validate_user_group_list:2556 got user (0:0), group (1:0) peer group (0).
[231:root:263]sslvpn_update_user_group_list:1749 got user (0:0), group (1:0), peer group (0) after update.
[231:root:263]two factor check for t****Y: off
[231:root:263]sslvpn_authenticate_user:167 authenticate user: [t****Y]
[231:root:263]sslvpn_authenticate_user:174 create fam state
[231:root:263][fam_auth_send_req_internal:425] Groups sent to FNBAM:
[231:root:263]group_desc[0].grpname = remote
[231:root:263][fam_auth_send_req_internal:437] FNBAM opt = 0X200420
[231:root:263]fam_auth_send_req_internal:513 fnbam_auth return: 7
[231:root:263][fam_auth_send_req_internal:539] Authenticated groups (1) by FNBAM:
[231:root:263]Received: auth_rsp_data.grp_list[0] = 2
[231:root:263]fam_auth_send_req_internal:562 found node remote:0:, valid:1
[231:root:263]Validated: auth_rsp_data.grp_list[0] = remote
[232:root:a29]allocSSLConn:298 sconn 0x34556e80 (0:root)
allocSSLConn:298 sconn 0x34556b00 (0:root)
[232:root:a29]SSL state:before SSL initialization (174.x.x.60)
SSL state:before SSL initialization (174.x.x.60)
[230:root:252]SSL state:before SSL initialization (174.x.x.60)
SSL state:before SSL initialization (174.x.x.60)
[232:root:a29]got SNI server name: 50.x.x.214 realm (null)
[232:root:a29]client cert requirement: no
[232:root:a29]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[232:root:a29]SSL state:SSLv3/TLS write server hello (174.x.x.60)
[232:root:a29]SSL state:SSLv3/TLS write change cipher spec (174.x.x.60)
[232:root:a29]SSL state:TLSv1.3 early data (174.x.x.60)
[232:root:a29]SSL state:TLSv1.3 early data:system lib(174.x.x.60)
[230:root:252]got SNI server name: 50.x.x.214 realm (null)
[230:root:252]client cert requirement: no
[230:root:252]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[230:root:252]SSL state:SSLv3/TLS write server hello (174.x.x.60)
[230:root:252]SSL state:SSLv3/TLS write change cipher spec (174.x.x.60)
[230:root:252]SSL state:TLSv1.3 early data (174.x.x.60)
[230:root:252]SSL state:TLSv1.3 early data:system lib(174.x.x.60)
[232:root:a29]SSL state:TLSv1.3 early data (174.x.x.60)
SSL state:TLSv1.3 early data (174.x.x.60)
[230:root:252]got SNI server name: 50.x.x.214 realm (null)
[230:root:252][232:root:a29]client cert requirement: no
got SNI server name: 50.x.x.214 realm (null)
[230:root:252]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[232:root:a29]client cert requirement: no
[232:root:a29]SSL state:SSLv3/TLS read client hello (174.x.x.60)
[230:root:252]SSL state:SSLv3/TLS write server hello (174.x.x.60)
[230:root:252]SSL state:TLSv1.3 write encrypted extensions (174.x.x.60)
[230:root:252]SSL state:SSLv3/TLS write certificate (174.x.x.60)
SSL state:SSLv3/TLS write server hello (174.x.x.60)
[232:root:a29]SSL state:TLSv1.3 write encrypted extensions (174.x.x.60)
[232:root:a29]SSL state:SSLv3/TLS write certificate (174.x.x.60)
[232:root:a29]SSL state:fatal internal error (174.x.x.60)
[232:root:a29]SSL state:error:(null)(174.x.x.60)
[232:root:a29]SSL_accept failed, 1:EVP lib
[232:root:a29]Destroy sconn 0x34556b00, connSize=1. (root)
[230:root:252]SSL state:fatal internal error (174.x.x.60)
[230:root:252]SSL state:error:(null)(174.x.x.60)
[230:root:252]SSL_accept failed, 1:EVP lib
[230:root:252]Destroy sconn 0x34556e80, connSize=3. (root)
[231:root:263]sslvpn_read_request_common,656, ret=-1 error=-1, sconn=0x34557200.
[231:root:263]Destroy sconn 0x34557200, connSize=2. (root)