The webchat function is by default accessed from port 9090, via url http://your.openfire.server:9090/webchat/, however with Apache, this port can be proxied to port 80 (or 443/SSL if desired), see http://www.igniterealtime.org/community/docs/DOC-1876. You don't really need any other ports open to the outside, unless your Spark agents are trying to login from non-internal IPs. If that is the case, then 5222 would need to be opened.

I had password protected the root, via mod_auth, but found Google's Chrome would trigger the auth pop-up because it was searching for favicon.ico in the root. I had considered using Apache RewriteRules as a resolution, but this did not work with SSL. My current thinking is to present the Admin console in a non-root URL, but I could not figure out how to do that. Anyone else know?

Are you using Spark client to service the queues? Openfire should be configured with Agents, and the Spark Fastpath tab should appear. Is this the case? If yes, can you connect without using the ProxyPass, e.g. going to http://webchat.externaldomain.com:9090/webchat/ and clicking the 'Online' link there? If so, there may be a proxypass caching issue.