Suppose I connect to the Wi-Fi of a company I trust enough to give them my credit card number (say, my local airport). When I connect to their Wi-Fi network, my web browser gets redirected from any page to their captive payment page.
With luck, they'd be using a company-owned domain and HTTPS. If I'm really lucky, it might even be an EV certificate with the company name on it.
It seems that some phones, in particular the current version of iOS, show any such captive forms in a special interface, instead of the standard browser. As best as I can tell from the official guide, there is no way in this special interface to check the SSL certificate. It shows the domain, but not the certificate status.
Does this interface only work if the portal uses HTTPS and the certificate is valid? Is there some way to see the actual certificate, or at least whether it's a domain certificate or EV? It's not uncommon for companies to use a weird separate domain that you can't know is theirs off the top of your head, but if they used EV on it then you have some confidence that it's theirs.