[rdin]

Unfortunately, it's been invalid for awhile. You can check it out for yourself here:

http://platform.twitter.com/widgets.js vs https://platform.twitter.com/widgets.js

[rubyskills]

Drat! Someone over at twitter should fix this. :(

Luckily, we don't use that js, we use:

http://twitter.com/javascripts/blogger.js

and I just checked the certificate behind this and it's valid (I should hope twitter's main cert is valid!):

https://twitter.com/javascripts/blogger.js

and we use the json API:

http://api.twitter.com/statuses/user_timeline/healpay.json?c...

which also happens to have a valid cert:

https://api.twitter.com/statuses/user_timeline/healpay.json?...

So it looks like we're in the clear for this at least :)