In Internet Explorer 9 or earlier, after switching the server to HTTP and HTTPS, users are unable to access layers of a web application hosted on ArcGIS Online containing services from ArcGIS for Server.
Opening individual services via the REST endpoint also fails. When attempting to add ArcGIS for Server secured services in an ArcGIS Online web map and login credentials are entered, the following error is returned: "Unable to access the authentication service."
This is a known issue. The services are secured with GIS-tier authentication, where users are authenticated using Esri's proprietary ArcGIS token-based authentication mechanism. The request to generate a token in the ArcGIS Online map viewer goes through the ArcGIS Online sharing proxy. The sharing proxy for ArcGIS Online (for example, http://ess.maps.arcgis.com/sharing/proxy) returns a "502 Bad Gateway" error in some cases when attempting to generate a token against an ArcGIS for Server token service if an alias is used for the server. Hence, when a REST service layer is added to ArcGIS Online, the following error displays: "Unable to access the authentication service."
The error, "Unable to access the authentication service", may also occur because of due to an expired Secure Sockets Layer (SSL) certificate. For more information, please refer to the Esri Knowledge Base article, Error: Unable to access the authentication service.
To enable cross-origin requests in each browser, refer to the instructions in the following page: Cross-Origin Requests in Internet Explorer, Firefox, Safari and Chrome page. For a basic functional map of CORS browsers, please navigate to the page, Cross-Origin Resource Sharing.
By default, the error does not occur in Mozilla Firefox or Google Chrome because these browsers allow the application to make the requests, whereas settings in Internet Explorer must be updated.