only use https for CA api