Other than reasons like others mentioned: security and/or not following public CA guidelines, there are also other government sites with invalid TLS certificates due to incompetence. I.E. https://www.12306.cn, the TLS cert is valid and signed by DigiCert but the common name field was not matching the domain the site is serving. ¯\_(ツ)_/¯ Also, I recalled they would asked you to download their own root cert to during the checkout process. This is a high-speed rail ticketing site being used by billions of people every year. Go figure.