def is_downgrades_https(domain):
    """
    Domain downgrades if HTTPS is supported in some way, but
    its canonical HTTPS endpoint immediately redirects internally to HTTP.
    """
    canonical, https, httpswww = (domain.canonical, domain.https, domain.
        httpswww)
    supports_https = (https.live and not https.https_bad_hostname or 
        httpswww.live and not httpswww.https_bad_hostname)
    if canonical.host == 'www':
        canonical_https = httpswww
    else:
        canonical_https = https
    return bool(supports_https and canonical_https.
        redirect_immediately_to_http and not canonical_https.
        redirect_immediately_to_external)
