This is also interesting for sites which can't acquire their own certificates (i.e., anything at .cu, .ir, .kp, .sd, and .sy).