An extra problem here is many app-embedded HTTP clients are configured to ignore HTTPS certificate validation.