Based on history of this type of attack, it can also be true with a valid certificate ;)