Have you tried setting the nsopenssl *Trace parameters (in the nsd.tcl file) to true? They may provide helpful feedback in the log.