I had some discussions with our R&D. Our ctrlX CORE - Node-RED App is already strengthened for security purposes. So all communication is only working via the reverse proxy and so needs https.
You could install the open source version of the "normal" Node-RED snap to your ctrlX CORE then you are not bound to our security mechanisms. But beware that there is no warranty, bug fixing or intense support for this way. See this thread for further information.
... View more