Anyone interested in how certificates work in "the real world" should install Certificate Patrol (I think it's only for Firefox). You will quickly learn that c

Anyone interested in how certificates work in "the real world" should install Certificate Patrol (I think it's only for Firefox). You will quickly learn that certificates are 99% noise. Here are some observations: 1) ad sites present certificates, constantly changing. I don't care about them, but at the moment there is no way to tell Certificate Patrol to completely ignore certificates from a domain. The vast majority of certificates presented to a browser are from ad sites. 2) major websites use a plethora of constantly changing certificates. Quite often even the root signing certificate changes. Certificates change in days or weeks, not months or years as might be expected by simply looking at validity dates. 3) Some commenter [1] linked to an mitm paper written by Facebook people. It's enlightening. The paper also makes the point that while a certificate identifies a website, it doesn't identify a browser. So, even ignoring all the possible firewall MITM and malware, how can a website be sure that a user is who he says he is? Only half the problem is solved unless the user presents a certificate to the website. Most aren't set up for that. [1] https://news.ycombinator.com/item?id=7826420 https://news.ycombinator.com/item?id=7826420