Maybe something related to Chrome 42 SHA-1 sunsetting? http://googleonlinesecurity.blogspot.it/2014/09/gradually-su...

Server-side configs seem to be OK: https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina...

Cached chain with SHA-1 certs preferred over SHA-2 sent by server?

Maybe these links may help:

- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774195

- https://code.google.com/p/chromium/issues/detail?id=437733

My 2 cents

The bugs you've linked at the bottom look like they're the right ones.

Thanks for the help, and I hope the fix gets pushed down soon.

I just tested on Chrome 42 on Debian 8. I'm seeing the exact same certificate as you according to the displayed fingerprints, but I am getting no such warning.

I'm also getting this warning on 42, debian 8