In Wireshark, do you see who is closing the connection? Which connection is closed first: SSL or TCP? In Asterisk CLI, do you see a SIP message at that time when "sip set debug on" was enabled? Is it a SIP-REGISTER?