I apologize if this is not the best place to ask my question on the stackexchange network, I couldn't figure out where to get enough attention and be relevant.
Facebook provides a SSL host, it can be accessed by https://www.facebook.com. Basically, as I understand it, changes in the certificate should only occur when the old certificate is to be removed. However, perspective (an addon for firefox, checking fingerprints from many servers) find inconsistencies in the fingerprints of facebook. I am concerned and I would like your insights about this matter.
EDIT: explanation of the screenshot
Notary and current key column lists all the servers that tried to access www.facebook.com, and what fingerprint they found in the host's certificate. The Key history shows key changes over a period of 30 days. We can therefore conjecture that:
- Globally, certificate changes occur
- One certificate (blue) seems to be the main certificate
- The others replace it sometimes and are rather suspicious
Why would facebook change their certificate in this manner? Is it a common/safe practice?
I understand that PKI with Certification authorities are not very secure, I know that it's easy for some people (either rich, powerful or knowledgeble) to get a certificate for whatever domain they wish. But before going all paranoid, I wish to know if there's a logical explanation that has nothing to do with security.
As a comparison here is the notary results for https://encrypted.google.com:
Certificate changes occur regularly, however the browser's key can be seen only once on a 30 days period. I start to think that nothing is really fishy, but these practices seem to undermine perspective's usefulness and requires users to trust corporations. They should at least provide some kind of explanation for this and why not, a list of their certificate fingerprints.
Bounty: I'd like so see some references about such a system, surely it is possible to find a specification or document recommending such a configuration with multiples certificates within a same regional cluster as it seems to be the case for facebook. Also, if other credible theories exist please share them.
Thanks to answers and comments in this thread, we could figure out:
- Facebook indeed has different certificates
- Even behind a single IP (load balancer)
- Revoking a certificate and replace it would be easier this way
- Does this improve security?
- Keeping track of which server has which certificate looks tedious, is this method really worthwhile? It's not even scalable since certificates are different within a single regional cluster
- How about just keeping spare certificates in case of a leak? Keeping them versus deploying them all seems better from a security point of view: if one leaked, why not the others?
EDIT: accepted answer
Refer to the accepted answer and comments, I see things more clearly. It helped me understand the reasons behind such a setup, real life deployments may not be as simple as I originally thought. I find it sad that perspective addon is almost useless in such occasions though, but I can't expect facebook to care about this, it's meaningless for almost everyone. Thank you all for your input.