Addressing the unauthorized issuance of multiple TLS certificates for 1.1.1.1

Cloudflare reports that unauthorized certificates were issued for 1.1.1[.]1 by Fina CA, affecting its public DNS resolver service rather than any other Cloudflare properties. From February 2024 to August 2025, twelve certificates were issued for 1.1.1[.]1 without Cloudflare’s involvement, and all have since been revoked.

The incident arose because Fina CA issued these certificates for an IP address without proper domain control validation, with certificates shown to have been published on Certificate Transparency log servers. According to Fina CA, the certificates were issued for internal testing in the production environment, and an error occurred when entering the IP addresses.

Cloudflare notes that the issue highlighted how trust models depend on Certificate Transparency logs, and that such unauthorized issuances are not uncommon in history, though all identified certificates have been revoked and no evidence of misuse has been found so far. The company has outlined remediation steps, including improved alerts, extending CT monitoring to non-browser clients, and a plan to require CA participation in CT logs for future mitigations.