see #10230, see #10033 - big rework of HTTPS support for Remote Control:
HTTPS disabled by default, must be enabled in remote control preferences
Old certificate and private key removed from jar and Windows keystore if found, even if remote control disabled
New certificate generated at runtime with critical X509 extensions BasicConstraints (non-CA certificate), ExtendedKeyUsage (usage restriction for TLS server sessions)
New passwords generated at runtime (but stored in clear in user preferences)
Private key is no longer stored in Windows keystore (only certificate)