Http upload using Prosodys mod_http_upload gives SSL error about monal HOT 3 CLOSED

I think it's not a mod_http_upload issue because i also have this problem with Monal but not with other Clients for iOS. It's sad that there's this error otherwise Monal would be quite nice.

from monal.

I can confirm this. I just looked for an IOS jabber client and tried Monal. Pretty good first impression. The only negative thing I noticed was this ssl issue when trying to send an image with prosody (mod_http_upload):

May 05 21:05:46 socket debug server.lua: auto-starting ssl negotiation...
May 05 21:05:46 socket debug server.lua: attempting to start tls on tcp{client}: 0x14bdab8
May 05 21:05:46 socket debug server.lua: accepted new client connection from 79.220.xxx.xxx:49448 to 10000
May 05 21:05:46 socket debug server.lua: ssl handshake error: no shared cipher
May 05 21:05:46 socket debug server.lua: closed client handler and removed socket from list

from monal.

Interesting, thanks for the report I think this is a good clue
"ssl handshake error: no shared cipher" . I think it might be an SSL configuration on the server.
The connections are standard iOS HTTPS connections. There isn't much I can configure short of reducing the security requirements.

his might be helpful: http://useyourloaf.com/blog/app-transport-security/
the list of requirements on this page as well:
https://infinum.co/the-capsized-eight/articles/using-app-transport-security-ios9-makes-your-apps-a-little-bit-more-secure

Specifically none of the listed ciphers are available on @Mrfuyu 's server. On a mac, try
nscurl --ats-diagnostics (your server)

to see if it works on iOS and OS X.

ATS list of requirements
Here is the list of requirements from Apple docs that ATS specifies:

The server must support at least Transport Layer Security (TLS) protocol version 1.2.
Connection ciphers are limited to those that provide forward secrecy (see the list of ciphers below.)
Certificates must be signed using a SHA256 or better signature hash algorithm, with either a 2048 bit or greater RSA key or a 256 bit or greater Elliptic-Curve (ECC) key. Invalid certificates result in a hard failure and no connection.
These are the accepted ciphers:

TLSECDHEECDSAWITHAES256GCM_SHA384
TLSECDHEECDSAWITHAES128GCM_SHA256
TLSECDHEECDSAWITHAES256CBC_SHA384
TLSECDHEECDSAWITHAES256CBC_SHA
TLSECDHEECDSAWITHAES128CBC_SHA256
TLSECDHEECDSAWITHAES128CBC_SHA
TLSECDHERSAWITHAES256GCM_SHA384
TLSECDHERSAWITHAES128GCM_SHA256
TLSECDHERSAWITHAES256CBC_SHA384
TLSECDHERSAWITHAES128CBC_SHA256
TLSECDHERSAWITHAES128CBC_SHA

from monal.