diff --git a/cmd/scheduler/app/server.go b/cmd/scheduler/app/server.go
index 7a3ff45fc2..e9edb3d6c6 100644
--- a/cmd/scheduler/app/server.go
+++ b/cmd/scheduler/app/server.go
@@ -86,7 +86,13 @@ func startHTTP(s *SchedulerServer) error {
 	}
 
 	log.Infof("Start server on: %s:%d", s.Address, s.Port)
-	return server.ListenAndServe()
+
+	if o.GetOptions().EnableSsl {
+		return server.ListenAndServeTLS(o.GetOptions().SslCertfile,
+			o.GetOptions().SslKeyfile)
+	} else {
+		return server.ListenAndServe()
+	}
 }
 
 func Execute() error {
diff --git a/cmd/scheduler/options/options.go b/cmd/scheduler/options/options.go
index 1eb42aa94e..6c243fc291 100644
--- a/cmd/scheduler/options/options.go
+++ b/cmd/scheduler/options/options.go
@@ -104,6 +104,10 @@ type Options struct {
 	AdminPasswd string `help:"Admin password" default:"eBVVSNaMeyzDnD8F" alias:"admin-password"`
 	AdminTenant string `help:"Admin tenant" default:"system" alias:"admin-tenant-name"`
 
+	EnableSsl   bool   `help:"Enable https"`
+	SslCertfile string `help:"ssl certification file"`
+	SslKeyfile  string `help:"ssl certification key file"`
+
 	// scheduler options
 	SchedulerOptions
 }
diff --git a/pkg/proxy/http.go b/pkg/proxy/http.go
index a7157d4581..4d23731a0d 100644
--- a/pkg/proxy/http.go
+++ b/pkg/proxy/http.go
@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"net/http"
 	"net/http/httputil"
@@ -48,6 +49,9 @@ func (p *SReverseProxy) ServeHTTP(ctx context.Context, w http.ResponseWriter, r
 	}
 	log.Debugf("Forwarding to servie: %q, url: %q", p.serviceName, remoteUrl.String())
 	proxy := httputil.NewSingleHostReverseProxy(remoteUrl)
+	proxy.Transport = &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+	}
 	r.Header.Del("Cookie")
 	r.Header.Del("X-Auth-Token")
 	proxy.ServeHTTP(w, r)
diff --git a/pkg/util/gin/middleware/keystone_auth.go b/pkg/util/gin/middleware/keystone_auth.go
index 53cf65db9d..39067df06d 100644
--- a/pkg/util/gin/middleware/keystone_auth.go
+++ b/pkg/util/gin/middleware/keystone_auth.go
@@ -3,6 +3,7 @@ package middleware
 import (
 	"fmt"
 	"net/http"
+	"strings"
 
 	"gopkg.in/gin-gonic/gin.v1"
 
@@ -15,6 +16,15 @@ const (
 
 func KeystoneTokenVerifyMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
+		// hack
+		escapeAuth := []string{"ping", "version", "metrics"}
+		for _, s := range escapeAuth {
+			if strings.HasSuffix(c.Request.URL.Path, s) {
+				c.Next()
+				return
+			}
+		}
+
 		token := c.Request.Header.Get(XAuthTokenKey)
 		if len(token) == 0 {
 			c.AbortWithError(http.StatusBadRequest, fmt.Errorf("Not found %s in http header.", XAuthTokenKey))
diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go
index d5fbccae24..d86ef761c4 100644
--- a/pkg/webconsole/service/service.go
+++ b/pkg/webconsole/service/service.go
@@ -2,7 +2,6 @@ package service
 
 import (
 	"net"
-	"net/http"
 	"net/url"
 	"os"
 	"strconv"
@@ -11,6 +10,7 @@ import (
 
 	"yunion.io/x/log"
 
+	"net/http"
 	"yunion.io/x/onecloud/pkg/cloudcommon"
 	"yunion.io/x/onecloud/pkg/webconsole"
 	o "yunion.io/x/onecloud/pkg/webconsole/options"
@@ -62,8 +62,18 @@ func start() {
 
 	addr := net.JoinHostPort(o.Options.Address, strconv.Itoa(o.Options.Port))
 	log.Infof("Start listen on %s", addr)
-	err := http.ListenAndServe(addr, root)
-	if err != nil {
-		log.Fatalf("%v", err)
+	if o.Options.EnableSsl {
+		err := http.ListenAndServeTLS(addr,
+			o.Options.SslCertfile,
+			o.Options.SslKeyfile,
+			root)
+		if err != nil && err != http.ErrServerClosed {
+			log.Fatalf("%v", err)
+		}
+	} else {
+		err := http.ListenAndServe(addr, root)
+		if err != nil {
+			log.Fatalf("%v", err)
+		}
 	}
 }