Currently, Tigase accepts C2S and S2S connections which are not TLS encrypted. As per tweet https://twitter.com/mikko_2014/status/1130098793997848576?s=20 it could be a good idea to enable C2S and S2S TLS requirement by default and allow administrators to disable this requirement on per vhost basis.