This is more of an extended comment than a complete answer.
I note you have to tell QGIS to ignore the GetMap / GetFeatureInfo URIs advertised in the GetCapabilities response. The service is HTTPS, the advertised URIs are all HTTP. I note too in QGIS that if you don't ignore these URI's you don't get a map... and the request goes to https:///.../index.html?, so that's the same error you are getting with the GetLegendGraphic, there is no graphic at that location, and there is no way of telling QGIS to ignore the advertised GetLegendGraphic location.
When you go to the advertised location for the GetLegendGraphic in a browser, the service redirects you to a graphic at an HTTPS address.
http://secure.erlangen.de/arcgiser/services/Luftbild2016/MapServer/WmsServer?request=GetLegendGraphic%26version=1.3.0%26format=image/png%26layer=0
This redirection fails in QGIS.
I'm not sure if this is a bug with QGIS, or a bug with the redirection in the service, or both. Certainly it seems an error for the GetCapabilities response to advertise URLs that are incorrect.
I chose the root layer (layer with ID 0 in QGIS), and I get an image (as below), so the service itself is working.
Coverage isn't 100%, and this applies even more so to the individual layers, so you will get a blank image if you choose an area of no data.
If you keep this layer on you will have all data, but it makes it difficult to work out what you are querying (you'll get results for all layers in a GetFeatureInfo request)/or looking at (you only get one legend).
If you want individual layers, something to note from the GetCapabilities response is that the layers are restricted by scale, that is to say they are not available at all scales.
For example layer 2 (Alluvial Fans) has the following information in the GetCapabilities response:
<MaxScaleDenominator>236235.119048</MaxScaleDenominator>
So if you are zoomed out too far, you won't get any data.
Couldn't find an alluvial fan, but below is another layer (Flood Hazard Zones) available when you zoom in.
See section 7.2.4.6.9 of the WMS 1.3.0 specification to learn more about Scale denominators.
SSL issues
When I view the WMS GetCapabilities in a browser I get a padlock that tells me the certificate is valid.
I've tried QGIS 2.18.3 on Windows 10, and QGIS 2.14.17 on Linux; both work. I haven't got access to a Mac to test, so it's difficult to know if this is some Mac OS issue, or some issue to do with the updated version of QGIS, or some issue localized to you.
Best Answer
It definitely works when you are zoomed in to a coal mining area beyond 1:70K.
If you check the getcapabilities you can see the
MaxScaleDenominator
is set. I suspect the server is calculating that in the internal projection of the data which is EPSG:27700 (again I'm guessing but it probably is) so if you are viewing in EPSG:4326 (as you are) then you seem to need to zoom in to 1:20K or so to see the layer.