It's also important to note that at least in firefox it's horrible to test this with self signed certificates. My experience on another websockets proxy was that if it's signed by a trusted CA, it's fine. I don't know how well it goes with self signed, but foreman serving the same.