TLS Certificate Mis-Issuance Exposes 1.1.1.1 DNS Service to Exploitation

Security researchers revealed that three unauthorized TLS certificates were issued in May 2025 for 1.1.1[.]1, the public DNS service run by Cloudflare and APNIC. The certificates were mis-issued by the Fina RDC 2020 certificate authority, potentially allowing attackers to intercept and decrypt encrypted DNS queries. Cloudflare confirmed that it did not request or authorise the issuance and said it immediately launched an investigation, contacting Fina, Microsoft, and Fina’s TSP supervisory body.

Microsoft indicated it had engaged the certificate authority to request immediate action and plans to block the rogue certificates by adding them to its disallowed certificate list, while noting the certificates evaded detection for nearly four months. The incident highlights a weakness in the internet’s public key infrastructure, where a compromised or mis-issued certificate can undermine trust for millions, and Certificate Transparency logs exist to help spot such mis-issuances. Cloudflare also stated that its WARP VPN service was not affected.