Thanks for the reply. A small update - I disabled TLS 1.1, but the error persists. I also limited Curl to using TLS 1.2, and it still succeeds.

For my current use case, I'm only using Cache, not IRIS, so I'm not sure what the difference would be. I suppose the Callin/Callout option would be ideal, and I've started researching it through your pointers, though I have no experience with much of it.
Perhaps there's the relational access option as well. There's Diesel as mentioned, as well as the odbc Rust crate that wraps the raw C interface.