diff --git a/devstack/lib/ironic b/devstack/lib/ironic
index dba8e48258..5947311fd1 100644
--- a/devstack/lib/ironic
+++ b/devstack/lib/ironic
@@ -488,6 +488,12 @@ if [ $IRONIC_DEFAULT_BOOT_OPTION != 'netboot' ] && [ $IRONIC_DEFAULT_BOOT_OPTION
     die $LINENO "Supported values for IRONIC_DEFAULT_BOOT_OPTION are 'netboot' and 'local' only."
 fi
 
+# TODO(pas-ha) find a way to (cross-)sign the custom CA bundle used by tls-proxy
+# with default iPXE cert - for reference see http://ipxe.org/crypto
+if [ $IRONIC_IPXE_USE_SWIFT == 'True' && is_service_enabled tls-proxy ]; then
+    die $LINENO "Ironic in DevStack does not yet support booting iPXE from HTTPS URLs"
+fi
+
 # Timeout for "manage" action. 2 minutes is more than enough.
 IRONIC_MANAGE_TIMEOUT=${IRONIC_MANAGE_TIMEOUT:-120}
 # Timeout for "provide" action. This involves cleaning. Generally, 15 minutes