https://gmail.com/ does not use a bad certificate. Here is its current certificate, as intercepted by Fiddler2:
== Server Certificate ==========
CN=gmail.com, O=Google Inc, L=Mountain View, S=California, C=US
CN=Google Internet Authority G2, O=Google Inc, C=US
16/07/2014 10:04:37 PM
14/10/2014 11:00:00 AM
The actual response type from the HTTP request is a
301 Moved Permanently to
https://mail.google.com/. This has two effects:
The browser will redirect to the destination, making a new request, with a new tunnel (because different domain) and different certificate. This is why you see a
mail.google.com certificate - this is after the redirect. If you look at the address bar, the actual site you are on is
http://gmail.com/. It's a bit hard to catch the pre-redirect certificate in a browser, which is why I used Fiddler2.
The browser will cache this redirect and perform it automatically in the future, never making another request to
https://gmail.com/ (that's the point of
Moved Permanently). This isn't really significant to this question, but it does make it a bit harder to discover the redirect - you need to clear your caches or open a private browsing window first.