invalid certificate

On some machines (so far two windows machines and one linux) I am getting an invalid certificate when pulling. It seems this began Oct 1. You can see the daily runs of one of our buildbot instances stopped on Oct 1, with the error

hg --verbose pull https://foss.heptapod.net/pypy/pypy/
 in dir /home/buildslave/build_dir/jit-benchmark-linux-x86-64/build (timeout 1200 secs)
 watching logfiles {}
 argv: ['hg', '--verbose', 'pull', 'https://foss.heptapod.net/pypy/pypy/']
 using PTY: False
pulling from https://foss.heptapod.net/pypy/pypy/
abort: error: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)
program finished with exit code 255
elapsedTime=0.112225

If I download the cert used in firefox and add it via a

[web]
cacerts = file.pem

section in .hgrc, the connection succeeds.