or change domain to the certificate's CN or leave http when the certificate's CN doesn't match the domain. Closes #28661.