On a home LAN I encountered this error both in Linux Firefox (an ubuntu vmware VM on Win7) and from my Android phone browser from a shopping website during the checkout process a few days ago. Could this indicate some sort of MITM compromise (eg in the LAN router)? DNS compromise? Could this also be from one of the content delivery network (CDN) machines serving the paypal content being incorrectly configured or being compromised?
This Connection is Untrusted
You have asked Firefox to connect securely to www.paypal.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.
What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.
This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.
www.paypal.com uses an invalid security certificate.
The certificate is only valid for the following names:
google.com, *.2mdn.net, *.android.com, *.appengine.google.com (many more names...)
Running nslookup on the linux machine
www.paypal.com canonical name = www.paypal.com.akadns.net.
www.paypal.com.akadns.net canonical name = ppdirect.paypal.com.akadns.net.
ppdirect.paypal.com.akadns.net canonical name = wlb.paypal.com.akadns.net.
wlb.paypal.com.akadns.net canonical name = www.paypal.com.edgekey.net.
www.paypal.com.edgekey.net canonical name = e3694.a.akamaiedge.net.
What would be a remediation plan? Replace the home LAN router? Would all the devices on the home LAN also be suspect?