After the conversion of all outgoing links to HTTPS, I now get this error.
I get that error for, near as I can tell, for any page rooted at
http://stackexchange.com/ but not for subdomains, such as
http://meta.stackexchange.com/. The offending source is
<script src="https://edge.quantserve.com/quant.js"></script>. (around line 1345 for the home page.) This only shows up in my Konqueror browser, which seems to be stricter than Firefox, which doesn't complain when loading the SE pages, but does give and error if I directly load the offending URL. (Possible bug, or security issue with Firefox.) Interestingly enough, that tag is absent in the HTTPS version of the same pages, so I don't know how it would respond when the browser is supposed to check the page for mixed content.
Retrieving the certificate offered from that URL yields
Certificate: Data: Version: 3 (0x2) Serial Number: 63:b9:ec:7e:ff:98:83:35:f1:13:d6:7d:2f:86:4d:35 Signature Algorithm: ecdsa-with-SHA256 Issuer: C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 ECC 256 bit SSL CA - G2 Validity Not Before: Jul 28 00:00:00 2016 GMT Not After : Jul 28 23:59:59 2017 GMT Subject: C=US, ST=Massachusetts, L=Cambridge, O=Akamai Technologies, Inc., CN=a248.e.akamai.net Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: 04:02:a6:fc:13:cd:66:f5:ba:aa:2c:a8:4e:76:22: d3:ee:90:7e:b3:61:bc:75:1a:3b:d3:c7:80:60:1c: 6b:a5:45:d8:2d:f6:9b:27:1f:26:cb:2e:fe:34:e2: 35:d2:9a:dd:4a:92:2b:4f:eb:19:a8:90:10:38:a9: bd:47:66:74:2b ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Subject Alternative Name: DNS:*.akamaihd.net, DNS:*.akamaihd-staging.net, DNS:*.akamaized-staging.net, DNS:*.akamaized.net, DNS:a248.e.akamai.net X509v3 Basic Constraints: CA:FALSE X509v3 Key Usage: critical Digital Signature X509v3 Certificate Policies: Policy: 22.214.171.124.2.2 CPS: https://d.symcb.com/cps User Notice: Explicit Text: https://d.symcb.com/rpa X509v3 CRL Distribution Points: Full Name: URI:http://rc.symcb.com/rc.crl X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 Authority Key Identifier: keyid:25:F0:8A:E1:4B:7A:D9:01:95:0A:ED:C6:53:F1:8C:78:1F:D9:F3:F8 Authority Information Access: OCSP - URI:http://rc.symcd.com CA Issuers - URI:http://rc.symcb.com/rc.crt CT Precertificate SCTs: Signed Certificate Timestamp: Version : v1(0) Log ID : DD:EB:1D:2B:7A:0D:4F:A6:20:8B:81:AD:81:68:70:7E: 2E:8E:9D:01:D5:5C:88:8D:3D:11:C4:CD:B6:EC:BE:CC Timestamp : Jul 28 20:05:03.628 2016 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:D2:39:E1:01:CD:38:CA:D3:2A:C1:CA: 73:76:17:A9:0E:89:71:93:8F:CB:CB:4D:73:ED:36:F3: 86:B7:44:9B:AF:02:20:30:68:AA:47:C7:79:47:FF:12: 0C:B8:0D:CE:96:B4:5E:DD:E1:86:B3:E9:54:30:B4:F6: 6D:13:AD:A7:62:86:D6 Signed Certificate Timestamp: Version : v1(0) Log ID : A4:B9:09:90:B4:18:58:14:87:BB:13:A2:CC:67:70:0A: 3C:35:98:04:F9:1B:DF:B8:E3:77:CD:0E:C8:0D:DC:10 Timestamp : Jul 28 20:05:03.721 2016 GMT Extensions: none Signature : ecdsa-with-SHA256 30:45:02:21:00:B6:6B:FF:58:30:04:90:8C:CF:A0:09: 8D:83:CA:C3:07:78:71:8E:BA:83:13:6F:0E:F7:2A:5C: 1D:F2:DF:0C:A4:02:20:09:1E:C7:3B:65:B2:5A:3D:BE: F8:3C:F1:DA:DA:1C:B0:05:9F:A2:DE:84:E2:9A:F8:20: E6:1B:EE:E2:06:C8:52 Signature Algorithm: ecdsa-with-SHA256 30:45:02:21:00:9a:2c:bc:7b:38:29:8e:52:13:60:a1:95:ff: b3:aa:72:1b:31:38:a7:97:45:88:b2:49:9b:7b:ba:74:3c:3f: 8d:02:20:4b:cb:c1:d5:16:5e:bd:ec:9c:84:c6:d7:0c:fa:f1: e7:2f:d6:1e:f7:cf:cb:19:42:92:f1:d0:47:d4:d7:d7:9a
I don't know if the URL is co-owned with the subject of the certificate or not, but I'm not adding exceptions for miss-configured servers.
I realize that this is part of the overall migration to HTTPS for SE site-wide, and I expect that there will be other problems/bug to track down. In that vein, I'm not complaining about the error. Rather, I'm raising it so that the developers can track down problems and correct them. In this case it probably involves getting the third-party site to correct their issues.
This seemed like the best place to raise the issue. If it's better raised elsewhere, please tell me where and I can post it there instead.