Step 5: Server informs client that it is allowed to proceed:

   <proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>

   Step 5 (alt): Server informs client that TLS negotiation has failed
   and closes both stream and TCP connection:

   <failure xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
   </stream:stream>

   Step 6: Client and server attempt to complete TLS negotiation over
   the existing TCP connection.

   Step 7: If TLS negotiation is successful, client initiates a new
   stream to server:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 7 (alt): If TLS negotiation is unsuccessful, server closes TCP
   connection.

   Step 8: Server responds by sending a stream header to client along
   with any available stream features:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       from='example.com'
       id='c2s_234'
       version='1.0'>
   <stream:features>
     <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
       <mechanism>DIGEST-MD5</mechanism>
       <mechanism>PLAIN</mechanism>
       <mechanism>EXTERNAL</mechanism>
     </mechanisms>
   </stream:features>

   Step 9: Client continues with SASL negotiation (Section 6).
[download]

Further down in the RFC we have:

   Step 1: Client initiates stream to server:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       to='example.com'
       version='1.0'>

   Step 2: Server responds with a stream tag sent to client:

   <stream:stream
       xmlns='jabber:client'
       xmlns:stream='http://etherx.jabber.org/streams'
       id='c2s_234'
       from='example.com'
       version='1.0'>

   Step 3: Server informs client of available authentication mechanism
+s:

   <stream:features>
     <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
       <mechanism>DIGEST-MD5</mechanism>
       <mechanism>PLAIN</mechanism>
     </mechanisms>
   </stream:features>
[download]

But PCJ doesn't get the mechanisms. It looks like it chokes on the preceding stanza. At least, that's how I see it right now. Hmmm.