Assuming you're running an IT department for something serious, you could theoretically get a sophisticated enough router (like a Pineapple) you can force all unencrypted traffic through it to an internal CA that you manually install on all clients. Then just do the opposite of a protocol downgrade attack, lol.