[exim] TLS on connect and Microsoft MUA confusion.

Hello Exim Sages,

I've been running Exim for a close to two years now without many
issues; but I've had this persistent inability to configure Exim to
work with authenticate on send in conjunction with some of the
Microsoft MUAs.

Now i know these MUAs are often not compliant etc but I am also aware
it's possible to massage Exim into working with them. I've tried
several times but I'm now reaching out for help.

I'm currently running Exim 4.72. In my Exim configuration file I have

daemon_smtp_port = smtp : smtps : submission # 25, 465, 587
tls_on_connect_ports = 465

Now in my log file it tells me Exim has started with STMP on ports 25,
and 587 and SMTPS on port 465. So that looks correct for working with
Microsoft MUA's but when I try to connect using 465 and SSL using
Windows Live Mail for example, I get the error message in my log file:

"SMTP protocol synchronization error (input sent without waiting for
greeting):"

If understand correctly this is characteristic of tls on connect problems ?

Furthermore; to confuse me further; when I start exim using
-tls-on-connect at the command line - it works with my Microsoft MUA
without issue. I though perhaps it was connecting to another port that
465 but I saw no evidence of this, in fact both other ports (25, 587)
are firewalled from client.

Does -tls-on-connect do something slightly different from the config
directive tls_on_connect_ports apart from allowing you to select
specific ports?

Chris K.