ARP poisoning has redirected traffic through the attacker, who is attempting a man-in-the-middle; TLS certificate validation exposes the interception.

A rogue DHCP server has issued duplicate addresses; the warnings appear because two hosts share one IP.

Passive sniffing is under way; the warnings appear because captured packets are re-sent to the browser out of order.

A DDoS amplification attack is under way; the warnings appear because the gateway is too overloaded to complete the handshake.