Is there a proxy on the customer's network? I have seen this when a proxy exists, and all browsers send their HTTP and HTTPS connections through - if you do this, you have to install a certificate on the proxy. If that certificate does not exist or it is self-signed, you get those kind of warnings. Which means the "secure" connection is then from local browser to proxy, and the proxy establishes a new secure connection between itself and the actual site. Of course it allows eavesdropping ... anyone with access to the proxy can read all requests/responses in cleartext even if HTTPS. But some companies do this.