sorry, should have poked around a bit more - OTOH it did turn up Josh's pointer to org.labkey.api.util.HttpsUtil.disableValidation(), maybe I'll take a poke at that if nobody else is planning to.