you can in theory connect unencrypted and then send a HTTP Upgrade