And this is unquestionably a bug on the site itself. There is zero excuse for serving invalid certificates.
If the site does not want to be accessible over HTTPS (and I'll refrain from adding to the argument against that even though every bone in my body wants to), then at the ABSOLUTE BARE MINIMUM it should not listen on port 443 at all - i.e. accessing
https://lua-users.org should return a simple 404 error, not a security warning.
