Is it possible to use the CtrlX's REST API via HTTP instead of HTTPS?

[Binarus]

Dear all,

as the title implies, we would like to use the CtrlX's REST API via HTTP, not HTTPS, for development purposes.

The reason is that we are developing a custom client program that communicates with the REST API, that we experience some diffculties with that and that it would be very convenient if we could simply use Wireshark to analyze those issues. But the latter is not possible at the moment (at least, not with reasonable effort) because Wireshark can't show the encrypted payloads.

Hence the question: Can we disable HTTPS on the CtrlX and enable HTTP instead?

Thank you very much in advance!

[CodeShepherd · Accepted solution]

No, this is not possible as it would break the security strategy and efforts taken for the control.

You would have to implement you own unsecure mechanism.

[ROFELO]

Some approaches on how to solve this:

• Use an intercepting proxy such as mitmproxy for sniffing
• Terminate the SSL connection separately using software like stunnel and then use Wireshark between stunnel and your client
• Export the connection secrets from your software and import them into Wireshark (SSLKEYLOGFILE)