I can reproduce this issue on Arch Linux, Emacs 26.2. To reproduce, I run
emacs -Q and eval the following in *scratch*

(package-initialize)
(package-install 'spinner)

Looks like the actual response says:
> Your browser sent a request that this server could not understand.
> Reason: You're speaking plain HTTP to an SSL-enabled server port.
> Instead use the HTTPS scheme to access this URL, please.

Since this only happens on HTTPS, it's a bit hard to MITM to figre out
what's actually going down. However, Wireshark shows some interesting
stuff: Emacs seems to complete a TLS handshake, then after some packets,
sends a TCP RST. Then, astonishingly, Emacs sends a plaintext HTTP request
_on port 443_ to the server.

I can provide the Wireshark pcap if needed, though I doubt it's too
helpful. Let me know if there's any other way I can help debug.

Thanks,
Christopher Cooper