I can reproduce this issue on Arch Linux, Emacs 26.2. To reproduce, I run emacs -Q and eval the following in *scratch*
(package-initialize)
(package-install 'spinner)
Looks like the actual response says:
> Your browser sent a request that this server could not understand.
> Reason: You're speaking plain HTTP to an SSL-enabled server port.
> Instead use the HTTPS scheme to access this URL, please.
Since this only happens on HTTPS, it's a bit hard to MITM to figre out what's actually going down. However, Wireshark shows some interesting stuff: Emacs seems to complete a TLS handshake, then after some packets, sends a TCP RST. Then, astonishingly, Emacs sends a plaintext HTTP request _on port 443_ to the server.
I can provide the Wireshark pcap if needed, though I doubt it's too helpful. Let me know if there's any other way I can help debug.
Thanks,
Christopher Cooper