Yup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.)

If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.