That's a very good explanation of the general state of affairs. But in my experience trying the Certificate Patrol add-on for Firefox for a few months, the ide

That's a very good explanation of the general state of affairs. But in my experience trying the Certificate Patrol add-on for Firefox for a few months, the ideal of "the authentic site's fingerprint" doesn't exist for big sites. It works for small sites like grc.com, but larger sites constantly present a variety of certificates. That variety seems to change every few days. Also certificate expiration times frequently change. Gibson does acknowledge "False-Positive Mismatches" but in my experience this is a big big problem that makes the single "fingerprint" idea almost useless. A smart add-on would eliminate a lot of these false positives. E.g. if your browser has already stored a certificate for a site and the new certificate is issued by the same CA to the same entity and the only difference is a new expiration date, why not silently accept the new one, while still remembering the old expiration? That's a risk I'd be willing to take. Same thing for multiple certificates from different issuers. I want to be warned only the first time a certificate is encountered. If the same one is encountered again next week or next month, then that's another "false-positive mismatch" that should be silently suppressed. And, realistically, why does there need to be an add-on? Mozilla gets something like $300 million per year in funding. What are they doing with all that money, if Firefox is still so vulnerable to this nonsense?