Chrome started flagging SSL where the cert has SHA-1 in the chain, iirc xkcd was used as an example of where this occurs further up the chain than the site's acutal cert.

Just checked, if you look at the rapidSSL CA cert, it uses SHA-1.