I've contacted the manufacturer who claims that according to RFC5630 it should send the request via TLS as it is registered as TLS. I have a feeling that the erronous behaviour is because they do not append "transport=tls" to the contact field, although they claim it is not required.