I could almost bet that they don't even validate certificates, IF they use any kind of encryption at all...