Check this Stack overflow thread. For us it was cached SHA1 certificates in the cert chain:

https://security.stackexchange.com/questions/109629/deprecat...

But yeah, it's a pain..