Apparently it's not on by default, but all of my browsers do and also warn me whenever a site does not support HTTPS (and require me to explicitly click through to the unencrypted connection).