Ok, the issue turned out to be that I was using "needClientAuth=true" rather than "transport.needClientAuth=true". The former worked for "ssl" and "amqp+ssl", but not for "wss".
-- Sent from: http://activemq.2283324.n4.nabble.com/ActiveMQ-User-f2341805.html