when using opportunistic TLS, also downgrade when error happen after
the session was negotiated