There exists some Cisco network gear that intentionally breaks STARTLS commands in it's default configuration (and wasn't debugging _that_ on a piece of network gear a client owned but didn't know about a fun waste of several weeks…)

( http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/produc... for anyone who wants details… )