Took me awhile to figure out what's going on, way longer than it should have. A one-sentence description at the top would have cleared it up. It is indeed the

Took me awhile to figure out what's going on, way longer than it should have. A one-sentence description at the top would have cleared it up. It is indeed the site itself that intends to be "bad". The site intentionally serves SSL certificates that are invalid or bad in various ways. Each subdomain is bad in a different way. You can test your code against these domains to ensure your code rejects the invalid or bad certificate.