support old clients withopenvpn on Debian bullseye

I'm trying to replace an openvpn server running Debian stretch and openvpn 2.4.0 with one running Debian bullseye and openvpn 2.5.7, unfortunately older clients running openvpn 2.3 on an old operating system are failing to connect to the new server. I can't easily upgrade these clients right now. the client says (censored).

Socket Buffers: R=[163840->131072] S=[163840->131072]UDPv4 link local: [undef]UDPv4 link remote: [AF_INET]xx.xx.xx.xx:1194TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=xxxxxx xxxxxx

It then hangs for a while and then reports.

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)TLS handshake failed

I've googled around a bit but struggled to find a solution, I found an answer about data channel ciphers, but things don't even seem to be getting as far as establishing the data channel.