The RAG client doesn't handle the no_host_verification TLS security mode. The internal check only looks for insecure for bypassing the verification, so by default local instances fail to make the HTTP calls unless the client is specifically configured for insecure.