In case of cacert.org they are presenting a self-signed certificate and that's why your browser complains. There is no trust chain that leads from the certificate to a root CA that you trust.
If you were using a Linux distribution that comes with their certificate pre-installed, you wouldn't see a warning. It would inferred that by using such a system you trust the community.
In case of other OSs you put trust in PKI that is supported by Microsoft, Apple, Google, or Mozilla. Cacert.org is outside of this infrastructure and that's why you see a warning.
Why? Their "business" decision. They are free to do whatever they want when they provide web services. They could ask users to install their root CA, they could invest money and get a signed certificate for their website.
They chose the first model, because that fits their purpose and "eat your own dogfood" idea.
What you can do? It depends on what you want to do. You can access the site with http://cacert.org/ link and read.
If you still want to access with HTTPS, you can display the provided certificate, examine it yourself. Then you must take your own decision to trust it.
The tricky part is that it could be a MitM attack, so you should compare the fingerprint signature of the certificate you got with a signature you obtained through another trusted connection. They publish the fingerprints here but until you trust real them, you can't really trust the site. Catch-21.
You should either confirm the signature with another source you trust or, more practically, use Debian that comes with their root certificate pre-installed to access the site over HTTPS.
You can then follow the link to instructions how to install their root CA, install and trust the certificates they signed from now on (including their own one).