It would be great if we could access the API and web controller securely with HTTPS.

Background: we are an events company that uses vMix to produce virtual conferences. We have set up an automated "training" vMix instance that conference participants dial into via vMix Call, for the dual purpose of training them in the use of our platform and vMix call operation, and to test their browser/camera/mic to ensure they are able to connect and there are no firewall issues on their end. The training consists of participants watching a video playlist, and seeing their camera and audio meters to verify their camera/mic are working.

Use case: currently, the training video playlist runs on a loop, so if the participant calls in in the middle, they have to wait for the video to restart to see the whole thing. The idea is that we would like to embed the vMix call page in an HTML frame side-by-side with a control frame that has buttons so the user can pause, resume, or seek through the playlist. Also the page that houses these two components would send an API command to vMix to restart the playlist on page load, so the user always starts at the beginning of the video.

We've already built the proof-of-concept and it works - as long as the page is insecure (HTTP), for instance if the page is run locally. Problem is, once the page is then hosted securely (HTTPS), no modern browser will allow a secure page to send insecure commands. In other words, we can't send HTTP commands to vMix from an HTTPS page.

I know vMix wasn't designed to be controlled over the internet, but with the pandemic wholly remaking the landscape and remote work becoming the normal, the ability to send remote commands to vMix would be a very useful feature.

Actually yes. The newest version of Companion supports HTTPS control of its admin and API. So you map your desired vMix functions to Companion buttons, forward a port on your router to wherever you're running Companion, then send HTTPS commands to Companion's API to push the appropriate button.

Drawbacks: it's not all that secure and won't fly in a high-security IT environment. And if the end use-case is user-facing, you'll need to set up a certificate so the user doesn't get any browser warnings trying to connect. Also, the Companion devs explicitly say "you probably shouldn't try to use this through a firewall". That being said, it does work, but user beware.