Having a domain that can serve https is good and all, but it's no use if the client doesn't actually bother checking whether the cert is valid or not. The phenomenon is so prevalent that google needed to add a warning to developers in android's ssl socket documentation.