Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Facebook seems to be alternately serving two SSL certificates, one from DigiCert and one from VeriSign. There are only two reasons for this that I can think of:

  1. They're in the middle of a certificate change that hasn't propagated to all of their load-balanced servers yet. This seems unlikely as it's been going on for some time, and it's almost a year until the first certificate expires.
  2. I'm being man-in-the-middled. Also seems unlikely.

Why would Facebook do this, except for making paranoid people even more paranoid? I also remember Google serving lots of different SSL certificates half a year ago or so.

Edited to clarify my concern: Facebook apparently expects its users to accept any of the different certificates that it supplies, and not. If an attacker were to extract the certificate from one server farm, they could then use it to MITM a user on that or any other server farms, as the users are expected not to care about certificate changes. The traditional way to prevent this is to have users be wary about inexplicable certificate changes.

Normally, a user would just need to know if the current certificate was close to expire. In this case, she would need to maintain a list of currently used certificates and also need to know if Facebook just built a new server farm somewhere. Is there any way for a user to validate their concerns about a new certificate? I can only see this decreasing the security of the site.

For reference, the SHA1 fingerprints of the keys are D3:81:DE:E3:2C:9C:C9:F7:B6:6F:EE:41:1E:64:27:80:21:76:D0:BC and 63:08:84:E2:79:CB:11:07:F1:FB:8A:6B:11:A6:4D:1B:14:76:3F:8E.

share|improve this question
    
FYI, I get man-in-the-middle attacked while at work. It may not be as unlikely as you think... but they shouldn't show up as from legit CA's. –  user606723 Aug 24 '11 at 17:23
    
@user: I realise that some workplaces need such setups to filter encrypted traffic, but the alternatives here are a trojan, my Netgear router or my ISP. –  user1633 Aug 24 '11 at 17:26
1  
facebook also uses another two different certificates for its secure.facebook.com domain that is used for payment processing. Those are EV certs. –  john Sep 9 '11 at 12:21
    
I've learned a lot just by studying Facebook's public facing infrastructure. Several good/innovative choices there. –  makerofthings7 Sep 21 '11 at 0:17

4 Answers 4

They do things this way now so they won't break things in the future. If they always used the same certificate now, people might assume that things must be this way in the future. Then, if they ever had some need to rotate or change certificates, people would be disrupted by that change. By ensuring their certificates are not constant now, they make the point loud and clear that seeing a different certificate for them than you are used to is normal, thus preserving their ability to change certificates in the future.

share|improve this answer

Using different certificates authorities may be a form of redundancy. Without knowing details about Facebook, it seems to make sense to get different clusters as independent of each other as possible.

In case of a security breach which reveals private server keys or results in the creation of fraudulent certificates, they can rely on other clusters which don't use those private keys or the affected CA.

This seems to make even more sense if you think about security breaches which are caused from the inside by carelessness or even an internal attacker. The damage that an individual can cause is limited in this context. It's still extremely large but having half the server left until it is fixed is better than being completely offline.

share|improve this answer

Option 3 is that they don't want to put all of their CA eggs in the same basket. I know that various Apple.com certificates - all apparently legitimate - are issued by different CAs, so it could just be that these companies do not want to depend on a single supplier.

Why not? Well imagine that one CA is compromised, or goes out of business, or fails some audit such that one or more browser vendors decide to stop trusting its certificates. If they're your only provider of SSL certificates, that's a problem: you can't offer a good SSL experience until you find a new provider, establish a relationship with them, get new certificates issued, revoke the old ones and deploy the new ones. If you've got multiple CAs you just deploy one of your other existing certs into the places where the bad certificate is currently being used, revoke the bad cert, and you're good to go.

BTW, your description of Option 2 expresses one of the key problems with SSL: almost every warning you ever see is a false positive, so even when people are suspicious of the certificate (which is almost never anyway) they tend to assume that the problem is anything but a real attack. Browsers have cried wolf too often.

share|improve this answer
1  
What would option 3 defend against? It just seems to create more points of failure, since it would be enough to compromise one of the CAs/certificates. –  user1633 Aug 24 '11 at 9:08
4  
@Tim: Exactly the opposite. If one of the CAs gets compromised, they can remove certs issued by that CA quickly because they already have alternatives to rely on. There are more points of failure, but they are all less critical and they would have more escape routes. –  user185 Aug 24 '11 at 9:12
2  
"[one of the] browser vendors stop trusting its [CAs] certificates", oh, how much I'd like to actually see this... –  Hubert Kario Aug 24 '11 at 12:54
3  
@Hubert - it's done! Diginotar appears to be removed from FF, IE and Chrome:-) –  Rory Alsop Sep 9 '11 at 12:11
2  
@Rory I would wonder whether if, say, Verisign had failed in the same way, the vendors would have removed the root certs so readily. –  user185 Sep 13 '11 at 17:41

Perhaps you're ending up at different web farms. A site as big as facebook will not have a single point where they offload SSL, so they can either install the same certificate and private keys in all SSL endpoints, or use different certificates. As long as they're signed by a CA in your browser, you normally won't notice the difference.

share|improve this answer
    
My question is: why would they not use the same certificate at every server? –  user1633 Aug 24 '11 at 9:10
3  
I suspect there's an operational reason for that, not functionality or security. Say different clusters are in different continents and managed by different people. They can just both request their certificates instead of having to setup some sort of synchronization. –  chris Aug 24 '11 at 9:14
    
I think this is probably what's happening. And the answer probably isn't as rational as you think it should be. The answer is probably, "thats just the way it happened" –  user606723 Aug 24 '11 at 17:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.