It seems like a bad cert is being served at the redirect; the LE cert at https://search.marginalia.nu DOES have both the wildcard and apex domain

See https://news.ycombinator.com/item?id=30301015