Ситуация 1 (безопасная):
Ситуация 2 (небезопасно):
Насколько я понимаю, эти две ситуации неразличимы для меня как конечного пользователя, который никогда ранее не посещал данный веб-сайт. Что мне не хватает?
К вашему сведению, ситуация 1, очевидно, относится к * .wikipedia.org. Они сказали, что именно так Digicert переиздает сертификаты.
You can search for the Certificate Authority's CRL (i.e. http://www.verisign.com/repository/crl.html from VeriSign) and see if they have recently revoked an the old certificate but to do that you will generally need the old certificate's serial number. You could also, if you had the old serial number, just compare it to the new one.
The problem is that there isn't much you can really do to see if it is a different certificate than before without the old certificate serial number.
Zmap.io have a list of changes to certificates for the top 5,000 most popular sites. Note that the date listed there does not rely on the Not Valid Before date of the certificate itself and therefore should represent an accurate date for when the certificate was last changed. (I used Wikipedia.org to check this as they get their certificates from DigiCert who backdate the Not Valid Before date when re-keying certificates.)
They link to the raw data they used which presumably covers a lot more than just the top 5,000 sites but at the time I am writing this, the site is not responding.
Another project that collects certificate fingerprints is Convergence. I haven't explored yet to see if you can extract fingerprints and dates out of it but if you were using it before HeartBleed, it would probably warn you when a site's certificate changed (unless a majority of other people using it had already accepted the new certificate for that site). Ironically, no warning in this situation would be an indication that you were not safe and a warning would be an indication that you were safe.