> I understand the security concerns, but forms being able to debug with tshark (or an equivalent tool) is a very good reason for not using HTTPS internally. O

> I understand the security concerns, but forms being able to debug with tshark (or an equivalent tool) is a very good reason for not using HTTPS internally. One of the nice things about HTTPS is that it's just a SSL connection and the HTTP goes over it. It's not hard to use socat to create something which listens to TCP connections on one port, and wraps it in a SSL layer and sends that on to another host:port. This allows you to remove the S from HTTPS, and you then speak HTTP to it, and hence can use tcpdump (etc) to dump.