Status update:
HTTP Binding support (which should allow us to use HTTPS) is "mostly working" as of this afternoon. Connecting works, polling works well enough that sessions can stay connected indefinitely, messaging works, presence works. There are still a few bits that need work: sending a large number of messages in a row breaks things, detection of which connection method to use (http/https/socket) needs testing, and http/https connection is not actually enabled yet except in my local copy.
(this is all in SparkWeb Flex, which is not what the initial issue was about, just to clarify. SparkWeb JS should have working SSL as of Openfire 3.4)
The description is lacking.. sparkweb supports SSL, it just doesn't work. I have an openfire 3.3.2 server running on windows, and firefox is the client. Attempting to login using the SSL port results in "the pinwheel of death". The only error in the error log is "invalid session".