[exim] tls-on-connect - "TLS error on connection"

OK, I'm trying to support the evil MS Outlook and it's silly tls-on-connect
issue... I have TLS / smtpauth working great for non-outlook users on port
25 and 587 with the identical exim.conf file.

Outlook is configured for SMTP Auth, port 465, "this server requires a
secure connection (SSL)" checked.

Exim started with:

/usr/local/sbin/exim -bd -tls-on-connect -oX 465 -oP /var/run/exim.465.pid -d+tls

The transaction:
24809 Listening...
24809 Connection request from 64.222.230.220 port 2883
24809 LOG: MAIN
24809 SMTP connection from [64.222.230.220] I=[66.225.245.2]:465 (TCP/IP connection count = 1)
24809 search_tidyup called
24809 1 SMTP accept process running
24809 Listening...
24810 host in rfc1413_hosts? yes (matched "*")
24810 doing ident callback
24810 ident connection to 64.222.230.220 failed: Connection refused
24810 sender_fullhost = [64.222.230.220]
24810 sender_rcvhost = [64.222.230.220]
24810 Process 24810 is handling incoming connection from [64.222.230.220]
24810 checking for IP options
24810 no IP options found
24810 host in host_lookup? yes (matched "*")
24810 looking up host name for 64.222.230.220
24810 DNS lookup of 220.230.222.64.in-addr.arpa (PTR) succeeded
24810 IP address lookup yielded static-64-222-230-220.port.east.verizon.net
24810 gethostbyname looked up these IP addresses:
24810 name=static-64-222-230-220.port.east.verizon.net address=64.222.230.220
24810 checking addresses for static-64-222-230-220.port.east.verizon.net
24810 64.222.230.220 OK
24810 sender_fullhost = static-64-222-230-220.port.east.verizon.net [64.222.230.220]
24810 sender_rcvhost = static-64-222-230-220.port.east.verizon.net ([64.222.230.220])
24810 set_process_info: 24810 handling incoming connection from static-64-222-230-220.port.east.verizon.net [64.222.230.220] I=[66.225.245.2]:465
24810 tls_certificate file /etc/exim/mailcert.pem
24810 tls_privatekey file /etc/exim/mailkey.pem
24810 Initialized TLS
24810 host in tls_verify_hosts? no (option unset)
24810 host in tls_try_verify_hosts? no (option unset)
24810 Calling SSL_accept
24810 SSL info: before/accept initialization
24810 SSL info: before/accept initialization
24810 LOG: MAIN
24810 TLS error on connection from static-64-222-230-220.port.east.verizon.net [64.222.230.220] (SSL_accept): error:00000000:lib(0):func(0):reason(0)
24810 search_tidyup called
24809 child 24810 ended: status=0x0
24809 0 SMTP accept processes now running
24809 Listening...


So some random error is occuring very early in the transaction, but I don't
know what. Google and FAQ's came up empty... I am NOT using a self-signed
certificate - I bought one from InstanSSL.com. The certificate file
contains the chain as defined in 37.7 of the exim spec.

Any ideas?