--- a/plugins/mod_tls.lua	Mon Jan 23 10:45:20 2017 +0100
+++ b/plugins/mod_tls.lua	Mon Jan 23 10:46:42 2017 +0100
@@ -124,7 +124,7 @@
 end, 500);
 
 module:hook_stanza(xmlns_starttls, "proceed", function (session, stanza) -- luacheck: ignore 212/stanza
-	if session.type == "s2sout_unauthed" then
+	if session.type == "s2sout_unauthed" and can_do_tls(session) then
 		module:log("debug", "Proceeding with TLS on s2sout...");
 		session:reset_stream();
 		session.conn:starttls(session.ssl_ctx);