I'd keep trying to contact them then look at walking away. An SSL-related issue like that is not something you're going to get accused of hacking for reporting.

I'd keep trying to contact them then look at walking away. An SSL-related issue like that is not something you're going to get accused of hacking for reporting. If you're really serious you could contact your local information privacy directorate (in the UK this would be the Information Commissioner's Office - I don't know who it is for the US) and ask them to investigate.