Symptom
Sending through smtp.office365.com on port 587 fails with ssl3_get_record:wrong version number or error:1408F10B.
A common configuration shape in these cases: the connector is set to TLS 1.2, credentials are supplied, and authentication is set to Anonymous anyway.
Older StreamServe 5.6.2 deployments hit a second, harder wall: Microsoft's modern authentication requirements for Exchange Online.
Cause
Port 587 starts as a plain SMTP connection and upgrades to TLS through STARTTLS.
The wrong version number error is what it looks like when the client and server disagree about whether TLS starts immediately (implicit TLS) or after the SMTP upgrade.
A client attempting implicit TLS on a STARTTLS port reads a plaintext SMTP greeting where it expects a TLS record, and the OpenSSL layer reports exactly this error.
The precise connector setting behind the original report was never confirmed, so verify the negotiated mode in your own environment rather than assuming.
Separately, Microsoft has been retiring basic username/password authentication for Exchange Online. OAuth2 support exists in later Exstream releases, but the client-credentials flow is not universally available in every CE email path, so the supported path is release-specific.
Fix
Split the problem into transport and authentication, in that order.
For transport: test port 587 with the connector's STARTTLS mode explicitly configured, and test the same account with a known-good SMTP client to establish a baseline. If the client is attempting implicit TLS on 587, correct the transport mode, or use the port and mode combination your provider documents. Record the negotiated mode and the server response before touching certificates or cipher settings; changing those on a transport-mode mismatch only adds noise.
For authentication: on Exstream 22.3 and later, configure the OAuth2 path documented for the installed release and confirm its authorization-code or refresh-token requirements.
Do not label a credentialed connection Anonymous unless the connector documentation explicitly defines that mode as transport-level authentication separate from the supplied credentials.
For StreamServe 5.6.2, be realistic: use a supported SMTP relay in front of Office 365 or plan the upgrade. The legacy connector predates modern authentication and no amount of connector configuration will produce an OAuth2 flow it does not implement.
Establish the SMTP baseline outside Exstream
Test with a plain SMTP client from the same host, account, and port before changing the Exstream configuration. That baseline separates transport and account failures from connector-specific behavior.