> I don't see sites publish their certificate fingerprints anywhere which would at least allow some form of manual check. That's exactly what Google and the li

> I don't see sites publish their certificate fingerprints anywhere which would at least allow some form of manual check. That's exactly what Google and the likes are building in Certificate Transparency (http://www.certificate-transparency.org/ http://www.certificate-transparency.org/). It's basically a log of all modifications on any certificate chain that can be monitored by anyone who is interested so that misissuance can be detected. There's also the old Perspectives project which idea was forked into Convergence (https://en.wikipedia.org/wiki/Convergence_%28SSL%29 https://en.wikipedia.org/wiki/Convergence_%28SSL%29) by good ol' moxie. The idea: any number of independent entities run notary servers, and when you get the certificate for a domain you also ask the certificate for the same domain to those notaries; if they have the same certificate, it means you all have the same "view" of the domain, so everything is probably ok. If they differ, maybe you (or they) were MiTM'ed.