Maybe something related to Chrome 42 SHA-1 sunsetting? http://googleonlinesecurity.blogspot.it/2014/09/gradually-su...

Server-side configs seem to be OK: https://www.ssllabs.com/ssltest/analyze.html?d=news.ycombina...

Cached chain with SHA-1 certs preferred over SHA-2 sent by server?

Maybe these links may help:

- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774195

- https://code.google.com/p/chromium/issues/detail?id=437733

My 2 cents