http://www.hibernate.org does redirect to https://hibernate.org, though, which has a valid certificate.
It used to redirect to http://hibernate.org.

Maybe your XML parser downloads DTDs but for some reason it does not support SSL?

I'm looking into removing the redirection.