If you download a friend's site's unique HTTPS root certificate (independent of default browser-shipped ones), or you simply make a 'permanent exception' to an obscure self-signed cert, in Firefox, I wonder whether or how an attack by third parties (server-level and on the HTTP application layer) to discover the usage and storage of this unique and obscure HTTPS cert / authority, by you as a user on the web, is possible.
If discoverable by other servers or MITM who somehow use those same unique certs to check against your lookup / verification / browser response to them (if you have already accepted the same cert surely the timing will be quicker), they can then attack your privacy by knowing you use (or at least have accepted/installed) the aforementioned cert from your friend's site, or break anonymity via the concept of fingerprinting (only targeted fingerprinting).
What would be various ways for doing this, and the requirements for those methods? I am no security researcher, but can think of 1. server-side direct cert forging (but would that require acquiring my friend's private keys and thus less likely of a broad threat?), and 2. (but blockable by add-ons such as RequestPolicy if the user is aware), using cross-site requests involving the original friend's site without any impersonation/stealing/forging needed anyway, and somehow observing whether indeed, you have installed, or accepted that cert in this way.
If there are differences between browsers in such vulnerability, I use Firefox.