That theory turned out to be wrong, as I was able to confirm with "openssl client" that providing a self-signed and therefore invalid certificate to the lobby server works just fine. ejabberd in our configuration does just ignore any client certificate provided. Disabling requesting client certificates would be a workaround, but doesn't appear to be possible with ejabberd. Seems like SChannel is doing something weird, as my understanding is that the client code terminates the connection after the TLS connection got established, not ejabberd. The best way forward is probably somebody debugging this who's running Windows.

I believe that first image, used as reference for the ai, is carrying javelins? I at least think it's javelins, as the rider seems to be pulling it out of a quiver? It looks like it might be a large/long quiver but I'd need to find the original image to check.

Quick look at the gloox sources there is no explicit handling of client certs at all. Also https://learn.microsoft.com/en-us/windows/win32/secauthn/performing-authentication-using-schannel suggest Windows only looks for client certs if the server actually asks. Maybe you can configure ejabbered to not do that.

For reference: https://gitea.wildfiregames.com/0ad/0ad/issues/5396  I believe it's likely that this is caused by the same underlying problem.

That's great, perhaps broadcasting the matches on several social media platforms would promote both the game and the mod.