When a https site shows multiple finger prints, i.e.: md5 and sha1, or sha256 and sha1, how does the browser check? is it both just the "strongest" or whatever is convenient?
This question arose because somewhere it was stated that a site used weak protection because of sha1. But that site also showed a sha256 fingerprint.
Is it possible that because of also having sha1 that that counts as the weakest link for spoofing, man-in-the-middle etc.? (or in other cases md5 as weakest link).