> But I've never seen a captive portal using fake certificates either.

I never seen a captive portal using a valid certificate either. Not like I saw many captive portals (last time was like... 2018?) but still.