If the access is only over VPN then http is fine, that’s how I access my arr setup. You can create certificates and manually upload them to radarr and other sites but it’s not necessary.