I don't think that you are under attack.
When it comes to trusting certificates, one has to know that a certificate is trusted if it is signed by another authority's certificate / key, when the other authority's certificates / keys which are used for signing already are trusted. That is the so-called "chain of trust"; you may have heard this term already.
Now, every chain needs a begin. Practically, that means that for example a browser has some root certificates in it. These are hardcoded, and it is a gold mine for every company that manages to get it's own certificates hardcoded into browsers; in few moments, you will see why.
When a browser checks a certificate from a website A, it does basically the following:
- Check if the certificate is one of the root certificates
- If not, check if the certificate is signed by a root certificate
- If not, check if the certificate is signed by a certificate which is signed by a root certificate
... and so on. I am deliberately simplifying the situation and partly using slightly incorrect terms (actually, we talk about hashes, private and public keys and so on), but the principle should be clear now.
Regarding your question: I suspect that your software just hasn't these root certificates. You could easily test this by using other software. For example, try Firefox in case of websites; if Firefox also shows warnings, it may be dangerous.
Furthermore, certificates generally expire, and people may forget to renew them. This may happen even to the largest companies, as history has shown. Browsers and other software will issue warnings due to expired certificates. Last, certificates can be revoked; for example, if a criminal company manages to get a certificate which is signed by one of the well-known root certificates, for example a certificate from Verisign or such, then the certificate of that company has to be rendered invalid as soon as the company's criminal actions are known.
So my advice would be to test with other browsers and to open the certificate and check the reason for distrusting - any solid software will show it.
Regarding your other warning, there is no general advice. It can happen that parts of one single web document are secured and other parts are not. That is a fact we have to live with (showing the reasons going far beyond this post); the problem in this case is that you can't easily find out if it is the advertisement which is not secured or if it is your credit card number which is not secured.
If I contradict myself and give you a general advice: When giving the website personal information which could be abused in any way, I would leave it. Such mistakes let you see how serious a company takes its obligations for securing customers' personal data.