That's not... how that works, unless you clicked through a very loud, obvious TLS warning.
Yeah that sounds weird. Certificate pinning and HSTS should protect from that, right?