Spoke too soon
Everything worked without https when Scratch 3 running in browser on same machine as NodeRED but when trying to use across a LAN - it wanted webserver to be https again
So I edited my settings .js like this
...
// The `https` setting requires the `fs` module. Uncomment the following
// to make it available:
var fs = require("fs")
...
https: {
key: fs.readFileSync('ca.key'),
cert: fs.readFileSync('ca.pem')
},
...
httpNodeCors: {
origin: "*",
methods: "GET,PUT,POST,DELETE"
},
...
(my ssl certs are available here https://github.com/cymplecy/scratch_gpio/tree/v8 - stick them into /home/pi/.node-red)