They may be using a self-signed cert so it’s https://localhost and the browser is flagging the cert rather than localhost itself.