Thank you. That makes sense.
I switched things around to the way you recommended and got it to work, but there were a couple of bugs (surfaced by my environment) that I had to sidestep. I filed an issue here:
https://github.com/OpenSprinkler/OpenSprinkler-Firmware/issues/310
The background is that I made a couple of small mods to force TLS. I modified OpenSprinkler to only listen on localhost and added a tiny reverse proxy (in Go), in front of it. As I’ve described in the issue, there seems to be a UI problem which was preventing me from using remote port 443 for “Remote Station (IP)” station type. Another minor issue was that the function ‘void OpenSprinkler::switch_remotestation(RemoteIPStationData *data, bool turnon, uint16_t dur)’ doesn’t take a ‘usessl’ parameter and the UI doesn’t have a good way of letting the user to set it.