A Misissued Certificate Found for Cloudflare’s 1.1.1.1 DNS Service

Cybersecurity researchers have warned about three anomalous TLS certificates tied to Cloudflare’s 1.1.1[.]1 DNS service, issued in May 2025 but only disclosed recently. The certificates were issued by Fina RDC 2020, an intermediate authority under Fina Root CA, a root certificate operated by Croatia’s Fina, and are trusted under Microsoft’s Root Certificate Program, meaning they could be considered valid across Windows NT platforms.

Cloudflare said it did not authorise Fina to issue the certificates and said it had initiated an investigation and contacted Fina, Microsoft, and Fina’s TSP supervisory body to revoke trust in Fina or the mis-issued certificates, according to the official statement quoted in the report. Microsoft indicated it would block the affected certificates through its disallowed list, while noting that Fina Root CA is trusted only in its ecosystem, so users of other major browsers and OSes remain unaffected, as reported.

The exact root cause remains unclear, and it is not yet known who applied for the certificates on Cloudflare’s behalf, with the incident highlighting concerns around Certificate Transparency logs, as noted by the article according to Ars Technica.