Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Question

Recently while trying to log-in to facebook this notification starts to appear

at first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!
I thought it might be a fake certification applied by the ISP so I changed my account password and started to choose Cancel every time it pop's up, I expected that the page wont load! but nothing happened and on the contrary the web page continued to load normally?

can anyone explain what happining and clear the whole idea to me?
Thanks in advance.
p.s.: I'm using https

Edit: message shown again and here is the Show Certificate details

Answer 1

Check out Dan Kaminsky's blog post on mysterious Facebook certificates. The response from Facebook:

We’re safe. Turns out we just ordered new (smaller) certs from Verisign and deployed them to a few test LBs on Monday night. We’re currently serving a mixture of digicert and verisign certificates. One of our test LBs with the new cert: a.b.c.d:443

But then have a read of @JeffFerland's blog post inspired by this week's discovery of a spoofed google.com certificate.

So it can happen, and unless you are au fait with certs and the trust assumptions, you should check any time you get an odd warning.

Answer 2

started to choose Cancel every time it pop's up, I excpected the page not to load! but nothing happened and the web page continue to load normally?

Some web pages are a combination of secure content (passed through https) and non-secure content (passed through http). Providing secure content is expensive in terms of equipment, network latency, and cache faults. So, many websites use secure channels only for the content that needs protection. When you chose 'Cancel' the non-secure parts of the web site loaded and the secure components did not load. Since the majority of the content is likely not to be considered sensitive, you may not notice much difference.