Invalid SSL Certificate

[Justin Capella]

http.debian.net CNAME s to static.debian.org

which serves a roundrobin of addresses, using https:// presents a
certificate that expects a common name of www.debian.org -- you need
to aded SAN for the IPs (by the name I presume they are static)