The number of mis-issued 1.1.1.1 certificates grows. Here’s the latest.

The Ars Technica report confirms that three mis-issued TLS certificates for Cloudflare’s 1.1.1[.]1 service were discovered, with nine additional certificates issued since February 2024, bringing the total to 12. Cloudflare said that all certificates have since been revoked and that there is no evidence any of them were used maliciously to impersonate 1.1.1[.]1 services.

Fina CA indicated the certificates were issued for internal testing in the production environment, with an error caused by incorrect IP address entries, and said private keys remained within an environment it controlled and were destroyed; however, consent from the domain owner was not obtained. According to Cloudflare, the incident underscores the fragility of the TLS PKI and the need for monitoring, including Certificate Transparency logs, to prevent trust erosion across the web.

The piece also discusses Microsoft’s Root Certificate Program and notes Microsoft and the EU Trust Service are among the entities that by default trust Fina, while Google, Apple, and Mozilla do not.