Browse to these URLs with Firefox:
https://bugzilla.xfce.org/attachment.cgi?id=6585
https://bug-attachment.xfce.org/attachment.cgi?id=6585

Firefox reports:
bug-attachment.xfce.org uses an invalid security certificate. 
The certificate is only valid for the following names:
 bugzilla.xfce.org, xfce.org 
(Error code: ssl_error_bad_cert_domain)

Reproduce with:
$ curl -v 'https://bug-attachment.xfce.org/attachment.cgi?id=6585' |& grep error
* NSS error -12276 (SSL_ERROR_BAD_CERT_DOMAIN)