Client certificate configuration for BOSH uses a different property than the same feature for plain sockets. For BOSH, one needs to set: httpbind.client.cert.policy

We should have, but do not have, some kind of admin interface for this.

Reopening, as another change is needed, as mentioned:

I just tried it and I did not get the prompt to select a client certificate from Chrome. When I tested previously to discover the minimum changes required, "sslContextFactory.setWantClientAuth(true);" was necessary.

I believe that this issue can be worked around by explicitly defining a property named xmpp.bosh.ssl.client.truststore and have its value be the client truststore file path.

Looking at the code, I'd guess that adding the client certificates to {{truststore}} instead of client.truststore would also have done the trick. Can you confirm that?

Nonetheless, client.truststore is what Openfire traditionally used. We should revert back to that default, I think.

I have narrowed it down to this

String c2sTrustStoreLocation = JiveGlobals.getHomeDirectory() + File.separator + "resources" + File.separator + "security" + File.separator + "client.truststore";

sslContextFactory.setTrustStorePath(c2sTrustStoreLocation);
sslContextFactory.setWantClientAuth(true);