Kamailio could be ending the call, though it may also be one of the endpoints.
Anyway, if your clients are dialing sips: URIs, then it is required that the signaling be TLS end-to-end. If you are trying to translate TLS to TCP, you should use
sip:user@domain.com;transport=tls. This should enforce TLS from the client -> proxy, but allow the proxy to use its preferred transport.
The reason the call wouldn't end until it's established is because it's not until this time that the any party receives a list of Record-Route headers. If using sips: and a record-route comes back that indicates that a hop did not use TLS, the call would end.
Best,
Colin