Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:
- They're in the middle of a certificate change that hasn't propagated to all of their load-balanced servers yet. This seems unlikely as it's been going on for some time, and it's almost a year until the first certificate expires.
- I'm being man-in-the-middled. Also seems unlikely.
Why would Facebook do this, except for making paranoid people even more paranoid? I also remember Google serving lots of different SSL certificates half a year ago or so.
Edited to clarify my concern: Facebook apparently expects its users to accept any of the different certificates that it supplies, and not. If an attacker were to extract the certificate from one server farm, they could then use it to MITM a user on that or any other server farms, as the users are expected not to care about certificate changes. The traditional way to prevent this is to have users be wary about inexplicable certificate changes.
Normally, a user would just need to know if the current certificate was close to expire. In this case, she would need to maintain a list of currently used certificates and also need to know if Facebook just built a new server farm somewhere. Is there any way for a user to validate their concerns about a new certificate? I can only see this decreasing the security of the site.
For reference, the SHA1 fingerprints of the keys are