I noticed that when it comes to some websites (e.g. Twitter), the security certificate is changed when I log in and out of NordVPN - the SHA-1 digest is visibly different.
Keep in mind that not only I log out, but also deactivate nordvpnd with systemctl (on Fedora Linux) after doing so, otherwise the service would still be running in the background and potentially sniff on my network packets.
I then refresh the website and the certificate is different. It doesn't seem to happen with all websites, but that this is happening with even some of them is deeply alarming.
The browser (Brave) does not notify me, but this might have to do with my NordVPN service having access even to my private keys since it is installed on my machine. Which means that the service may choose to change them and making it seem like a legitimate request from my machine.
Could this be indicative of a MiTM attack, or just a misunderstanding on my part?