I'd much rather http2/3 with an expired cert over cleartext anyday.