I believe that typically a web server is used to proxy the BOSH traffic to Openfire. So your TLS connection can go to Apache and then Apache proxies it to Openfire. For Apache, I use a setting like so to proxy the traffic
ProxyPass /bosh http://openfire-bosh:5280/http-bind