Issue explained. It turned out that the root cause was Firefox’s internal '''HSTS preload list''', which most likely originates from the global HSTS list maintained at [http://hstspreload.org hstspreload.org]. Our website on a second-level domain had been mistakenly configured to return the following HTTP header: '''Strict-Transport-Security: max-age=63072000; includeSubDomains; preload''' Over time, this caused the domain (and its subdomains) to be included in the HSTS preload list. As a result, Firefox now automatically upgrades all requests to HTTPS for these hostnames using an internal redirect (HTTP 307), even if only HTTP is explicitly requested. That explains why http://<local server name> is silently rewritten to https://<local server name>, while accessing the service via a raw IP address continues to work. More information can be found here: [https://wiki.mozilla.org/SecurityEngineering/HTTP_Strict_Transport_Security_(HSTS)_Preload_List HTTP_Strict_Transport_Security_(HSTS)_Preload_List]

So, Firefox 145 just received our domain in the list and behaves accordingly. Now, we have to change at least "preload" directive on our web server, post request for removal from hstspreload.org and wait....