Searching internet for “OpenHAB TLS” lead me to this post which gave me the idea to look into conf/services/ where I found xmpp.cfg, and then the relevant bit:
# The Security mode used for the XMPP connection. Can be either 'required'
# or 'disabled'. Defaults to 'disabled', which means that TLS will not be used.
# Warning: If you change this to non-disabled, then you must make sure that your
# TLS server certificate can be validated, otherwhise the connection will fail.
securitymode=disabled
# The TLS Pin used to verify the XMPP service's certificate. Set this in case openhab's
# default SSLContext is unable to verfiy it (e.g. because the XMPP service uses a self-signed
# certificate). The PIN value is bascially the hash of the certificate in hex.
# You have to set 'xmpp:securitymode' to 'required' to enable TLS for XMPP connections.
# For information on how to generate the PIN visit https://github.com/Flowdalic/java-pinning
#tlspin=CERTSHA256:(bunch of numbers and letters)
Which all sounds vaguely familiar for some reason.
Anyway, I’ll get working on it, and then post back (hopefully) a solution. Thanks again @rlkoshak, some times all it needs is a fresh pair of eyes! 