The HTTPS certificate needs to correspond to the relay's domain and be signed by a valid entity. But I wouldn't be surprised if chinese software had a Governement-issued root certificate authority, which means the gov could craft certificates that'd be "valid"