[darkr]

Yeah.. That's suspicious.. Firefox uses it's own CA list, so if your install of firefox is up to date, and your system clock is correct then you are potentially being MITM'd...

If that is the case then your browser is exhibiting correct behavior.

For me, I can see that the root CA is USERTrust (SHA-384 sig, interestingly), and the server is presenting a valid intermediate (Gandi - also using a SHA-384 signature), then the site certificate (SHA-256 sig).

There is a secondary certification path though, coming from a old SHA1 AddTrust Root (but this is also in my trust store for Firefox).

[bphogan]

Same results on Chrome. I am not on a corporate network - I am at home.

Are there tools I can use to work my way through this?

[darkr]

Odd. Chrome also uses it's own trust store, distinct from system and Firefox..

OpenSSL is a good starting point:

openssl s_client -connect tails.boum.org:443

[pki]

type 'danger' on the warning page