make sure that they are using a real SSL, not a self certificate