Cloudflare 1.1.1.1 Hit by 12 Unauthorized Certificates: Fina CA’s Misissuance Raises Microsoft Trust Concerns

Cloudflare 1.1.1[.]1 was revealed to have twelve unauthorized certificates for its public DNS service, 1.1.1[.]1, issued by Croatia’s Fina CA since early 2024, far exceeding the initial report of three. The mississuance went undetected for nineteen months, despite the industry’s Certificate Transparency framework intended to log and audit certificates.

Cloudflare launched an internal investigation after reports from the security community, uncovering the twelve unauthorized certificates had been issued without Cloudflare’s consent.

In an emailed statement, Fina CA claimed the certificates were generated as part of an internal test of its issuance pipeline in a production environment, with an incorrect IP address entry blamed for the misissuance; according to Fina, the certificates were properly logged to CT servers, their private keys never left controlled environments, and they were destroyed before revocation.

Public Key Infrastructure experts note the problem lies with Microsoft’s continued trust in Fina CA, as Google, Apple and Mozilla have never trusted the authority, leaving Windows/Microsoft Edge users potentially exposed. Cloudflare acknowledged three shortcomings on its end, including alerts for certificates tied to IP addresses and the volume of domains and certificates making manual review impractical.