Try adding these:
swscan.apple.com (https)
swdist.apple.com (https)
It would be nice if there was a plugin that could configure these things from the browser.
I also have a browser plugin installed that complains about invalid certificate for my banking sites, so either I have to exclude those too or configure it so it checks only the IP address. (although I already trust my router firmware and use static ARP)