I can serve using HTTP on this domain should be enough to prove you can also serve HTTPS on this domain though.<p>It&#x27;s on the domain owner to avoid giving away control of their (sub)domain to a malicious party. Exactly the same as with regular HTTP and anything else that uses DNS.