Due to the way Prosody TLS configuration has been hardened, it will often happen for outgoing and incoming s2s connections to fail - depending on how recent the remote server accessing/being accessed is old.

This is a big problem that could cause a lot of interoperability issues.

Unfortunately, until version 0.10 comes out, it is not possible to implement distinct protocol/cipher configuration per-c2s or per-s2s - it has to be done for both.

The only solution for now is to disable hardening altogether, and update documentation. Documentation should clearly reflect the fact that TLS has not been hardened, why it has not been hardened, and point to the fact that once Prosody 0.10 is out, it should be possible to harden it appropriately.