I know, but I always just type apple.com. It is still a problem.
OS X talks to plenty of apple.com subdomains and there really is no reason not to use self-signed certificates for this kind of thing.
so it might still scare people away, and rightfully so: normal folks cannot distinguish a self signed certificate from a malicious used one f.e. used in phishing attempts.
What do you mean with "normal folks"? Nobody can possibly distinguish this, since an attacker would also just use a self-signed certificate.
https://www.sslshopper.com/ssl-checker.html#hostname=apple.c...
https://www.sslshopper.com/ssl-checker.html#hostname=www.app...