Yes, custom cert has to be used, otherwise browsing could be very annoying.