Amtrak and AGR have just notified us that they were aware of the bad certificate problem with the non-www page. It is NOT a scam or phishing page so all is well in Amtrakland!
*nod* that is a problem with all sites that use SSL certificates. Certificates are issued to a single particular host name (in this case www.amtrakguestrewards.com) but could also wind up being used to negotiate SSL for a related site (like amtrakguestrewards.com). The traffic is still secure/encrypted, but the difference between the host name it's issued to, and the host name it's used for, will give most browsers coniptions [sp?].This security feature is to prevent people from being duped by, say, *stolen* certificates...but in this case, despite your browser's complaints, so long as the URL in your address bar
has amtrakguestrewards.com, whether preceded by www. or not, it is safe. If it has something like amtrakguestrewards.hax0rs.org, steer far clear.