Why does Facebook serve several SSL certificates?

Question

Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:

1. They're in the middle of a certificate change that hasn't propagated to all of their load-balanced servers yet. This seems unlikely as it's been going on for some time, and it's almost a year until the first certificate expires.
2. I'm being man-in-the-middled. Also seems unlikely.

Why would Facebook do this, except for making paranoid people even more paranoid? I also remember Google serving lots of different SSL certificates half a year ago or so.

Edited to clarify my concern: Facebook apparently expects its users to accept any of the different certificates that it supplies, and not. If an attacker were to extract the certificate from one server farm, they could then use it to MITM a user on that or any other server farms, as the users are expected not to care about certificate changes. The traditional way to prevent this is to have users be wary about inexplicable certificate changes.

Normally, a user would just need to know if the current certificate was close to expire. In this case, she would need to maintain a list of currently used certificates and also need to know if Facebook just built a new server farm somewhere. Is there any way for a user to validate their concerns about a new certificate? I can only see this decreasing the security of the site.

For reference, the SHA1 fingerprints of the keys are D3:81:DE:E3:2C:9C:C9:F7:B6:6F:EE:41:1E:64:27:80:21:76:D0:BC and 63:08:84:E2:79:CB:11:07:F1:FB:8A:6B:11:A6:4D:1B:14:76:3F:8E.

Answer 1

Option 3 is that they don't want to put all of their CA eggs in the same basket. I know that various Apple.com certificates - all apparently legitimate - are issued by different CAs, so it could just be that these companies do not want to depend on a single supplier.

Why not? Well imagine that one CA is compromised, or goes out of business, or fails some audit such that one or more browser vendors decide to stop trusting its certificates. If they're your only provider of SSL certificates, that's a problem: you can't offer a good SSL experience until you find a new provider, establish a relationship with them, get new certificates issued, revoke the old ones and deploy the new ones. If you've got multiple CAs you just deploy one of your other existing certs into the places where the bad certificate is currently being used, revoke the bad cert, and you're good to go.

BTW, your description of Option 2 expresses one of the key problems with SSL: almost every warning you ever see is a false positive, so even when people are suspicious of the certificate (which is almost never anyway) they tend to assume that the problem is anything but a real attack. Browsers have cried wolf too often.

Answer 2

Perhaps you're ending up at different web farms. A site as big as facebook will not have a single point where they offload SSL, so they can either install the same certificate and private keys in all SSL endpoints, or use different certificates. As long as they're signed by a CA in your browser, you normally won't notice the difference.

Answer 3

Using different certificates authorities may be a form of redundancy. Without knowing details about Facebook, it seems to make sense to get different clusters as independent of each other as possible.

In case of a security breach which reveals private server keys or results in the creation of fraudulent certificates, they can rely on other clusters which don't use those private keys or the affected CA.

This seems to make even more sense if you think about security breaches which are caused from the inside by carelessness or even an internal attacker. The damage that an individual can cause is limited in this context. It's still extremely large but having half the server left until it is fixed is better than being completely offline.

Answer 4

They do things this way now so they won't break things in the future. If they always used the same certificate now, people might assume that things must be this way in the future. Then, if they ever had some need to rotate or change certificates, people would be disrupted by that change. By ensuring their certificates are not constant now, they make the point loud and clear that seeing a different certificate for them than you are used to is normal, thus preserving their ability to change certificates in the future.