This question already has an answer here:
Assuming the user realizes the connection is unsafe and doesn't send any secret data to the server, are there any risks of connecting to a website without a valid certificate using https? Does that open them up to any potential attacks?
Why do browsers use http instead of https if the connection is untrusted? As long as the browser displayed an error, wouldn't it be better to encrypt the connection anyway? At least then only one other party could read any data sent, instead of everything being sent in the clear. I mean, the average user won't notice that the connection is insecure in any case, so it seems like at least a small increase in security.