Answered the question myself....the inclusion of NodeID 1049 into the list was causing a false alert from this device b/c it doesn't use SSL. I ended up using the logic in the attached screenshot to get the job done and it's seemingly alerting the way I intended. Are there any items in this alert that I should change or take out? Thanks for the help!
