fix #774

Don't advertise sasl=EXTERNAL to clients who aren't connected over native TLS,
since even if they have TLS configured locally and they enable a client
certificate, that information will be discarded by the reverse proxy.

irc/handlers.go

@@ -591,7 +591,11 @@ func capHandler(server *Server, client *Client, msg ircmsg.Message, rb *Response
 				rb.session.capVersion = newVersion
 			}
 		}
-		sendCapLines(supportedCaps, config.Server.capValues)
+		capValues := config.Server.capValues
+		if !rb.session.IsCertFPCapable() {
+			capValues = config.Server.capValuesNoExternal
+		}
+		sendCapLines(supportedCaps, capValues)
 
 	case "LIST":
 		// values not sent on LIST