This issue affects only unreleased versions of Openfire prior to the 4.8.0 release.

Openfire has a ‘strict’ mode, that should prevent it from authenticating a server-to-server connection if TLS authentication fails.

Currently, the logs show that in these cases the outbound stanza is bounced, the logs do get a line suggesting that the S2S attempt is abandoned, but then proceed to do Dialback.

Under ‘strict’ configuration, the S2S connection should fail.