At the very least the user should be able to override the failing certificate check. So much "security" cargo culting is intentionally planned failure.