Actually, by default it seems to use HTTPS, and there were known issues when OCSM could not connect to DOT 8.x if https was not enabled there (usually after upgrade). It probably falls back to HTTP though in your case.
Which DOT version do you have? Check httpd.admin.ssl.enable. Is SSL setup (secureadmin)?
