http.debian.net CNAME s to static.debian.org which serves a roundrobin of addresses, using https:// presents a certificate that expects a common name of www.debian.org -- you need to aded SAN for the IPs (by the name I presume they are static)