I made sure the bacula director definition matched the bconsole config. From bacula-dir.conf:
Director { # define myself
Name = bacula1.example.com
DIRport = 9101 # where we listen for UA connections
QueryFile = "/etc/bacula/query.sql"
WorkingDirectory = "/var/spool/bacula"
PidDirectory = "/var/run"
Maximum Concurrent Jobs = 1
Password = "secret" # Console password
Messages = Daemon
TLS Certificate = /etc/pki/tls/certs/bacula1.example.com.crt
TLS Key = /etc/pki/tls/private/bacula1.example.com.key
TLS CA Certificate File = /etc/pki/CA/certs/ca.crt
TLS Enable = yes
TLS Require = yes
}