acess log on Directory server 9 and later shows replication happens over port 389 even through SSL replication over port 636 is specified in replication agreement.

Issue

Replication agreement:

dn: cn=replica1,,cn=replica,cn=dc\3Ddomain,cn=mapping tree,cn=config
objectClass: top
objectClass: nsDS5ReplicationAgreement
description: replica1
cn: replica1
nsDS5ReplicaRoot: dc=domain
nsDS5ReplicaHost: replica1.domain
nsDS5ReplicaPort: 636
nsDS5ReplicaBindDN: uid=replication,cn=config
nsDS5ReplicaTransportInfo: SSL
nsDS5ReplicaBindMethod: SIMPLE
nsDS5ReplicaCredentials: {DES}rlsfdsfswsSSSPxG78TEzrQA==
nsds5replicareapactive: 0
nsds5replicaLastUpdateStart: 20150911030025Z
nsds5replicaLastUpdateEnd: 20150911030025Z
nsds5replicaChangesSentSinceStartup:
nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd
 ate succeeded
nsds5replicaUpdateInProgress: FALSE
nsds5replicaLastInitStart: 20150911030022Z
nsds5replicaLastInitEnd: 20150911030025Z
nsds5replicaLastInitStatus: 0 Total update succeeded

We enabled SSL and netstat -tunlp shows port 636 is open and listening. But for some reason replica access log shows replication operates over port 389.
Replication is working okay.