A surprising number of high-traffic sites have TLS vulnerabilities that are subtle enough for the green padlock to still appear.

Original source: https://www.wired.com/story/https-isnt-always-as-secure-as-it-seems