If you use Firefox/Thunderbird in Mac OS, you still need to untrust the CNNIC certs follow the steps in Screenshot: Remove CNNIC from Firefox and Thunderbird.

In Mac OS X: Click Applications -> Utilities -> Keychain Access -> Certificates -> (expand with V button below) -> System Roots -> (Unlock, top left) -> Double-click the cert -> Trust -> When using this Certificate -> Never Trust.

This will untrust the CNNIC certificates in Safari and any other apps that use the keychain access as their certificate manager.