Hmm, can't reproduce it myself, but firefox has a nasty habit of quietly "repairing" these types of misconfigurations by redirecting from one subdomain to another. I've added marginalia.nu as a SAN, should hopefully work now.