Rogue TLS Certificates for 1.1.1.1: Cloudflare Details Unauthorized Issuance by Fina CA

Cloudflare has disclosed that multiple TLS certificates for its well-known public DNS resolver at IP address 1.1.1.1 were issued without its authorization by a certificate authority called Fina CA. A TLS certificate acts as a digital identity card that lets your device confirm it is talking to the genuine server when you use encrypted DNS protocols like DNS over HTTPS (DoH) or DNS over TLS (DoT). These protocols protect your DNS queries, which are the requests your device makes to translate a website name into an IP address, from being read or altered by third parties. If a rogue certificate is accepted, an attacker could impersonate the 1.1.1.1 service and intercept or manipulate your internet traffic. This incident underscores why certificate validation and transparency are critical for the trustworthiness of encrypted DNS.

According to Cloudflare, Fina CA issued the certificates for 'internal testing of certificate issuance in the production environment.' Fina CA stated that an error occurred when entering IP addresses and that the certificates were published to Certificate Transparency (CT) log servers, which are public, append-only ledgers of all issued certificates. Cloudflare emphasized that publishing test certificates to CT logs is not itself an error; the real mistake was that Fina CA used its production signing keys to issue a certificate for the 1.1.1.1 IP address without the permission of Cloudflare, the controller of that address. Fina should have used an IP address it controls itself, Cloudflare said. The unauthorized certificates were discovered because Fina CA did submit them to CT logs.

Unauthorized certificates are not rare. In November 2024, the certificate authority IdenTrust issued certificates due to negligence. More famously, in 2011, the Dutch CA DigiNotar was hacked and its keys were used to issue hundreds of fraudulent certificates. That incident was a wake-up call and motivated the introduction of Certificate Transparency, later formalized in RFC 6962. CT does not directly prevent misissuance but enables detection after the fact by making every certificate publicly visible. Several independent parties, including Cloudflare, operate public CT logs. Modern browsers generally require proof that a certificate has been logged in at least two CT logs before accepting it, but most DNS clients do not have this requirement. Cloudflare was fortunate that Fina CA did log the rogue certificates, allowing discovery through services like crt.sh or Cloudflare Radar's certificate transparency page.

Cloudflare's immediate concern was whether someone had used the certificates maliciously to impersonate 1.1.1.1. Such an attack would require three things: a rogue certificate and its private key (the secret counterpart that proves ownership of the certificate), attacked clients that trust the Fina CA, and the ability to intercept traffic between clients and 1.1.1.1. Cloudflare knows a certificate was issued without its involvement, so it must assume a private key exists outside its control. Fina CA told Cloudflare that the private keys were exclusively in its controlled environment and were destroyed before the certificates were revoked, but Cloudflare cannot verify this and continues to take steps to detect malicious use. On the second requirement, Fina CA is included by default in Microsoft's root store (the built-in list of trusted certificate authorities in Windows) and in an EU Trust Service provider's list, but it is not in the default root stores of Android, Apple, Mozilla, or Chrome. Therefore, users on those platforms with default settings could not have been affected. The certificate shown in Cloudflare's report had serial number 02:7d:c8:c5:e1:72:94:ae:c9:ed:3f:67:72:8e:8a:08 and was issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, though the unauthorized Fina CA certificates would have had their own details.

In response, Cloudflare is monitoring certificate transparency logs and has detection mechanisms in place to spot any use of these rogue certificates. The company urges domain owners and IP address controllers to monitor CT logs for any unexpected certificates. For everyday internet users, the incident is a reminder that the security of encrypted DNS depends on the certificate authority system. Choosing a DNS resolver that actively monitors for misuse and has a strong track record can reduce risk. For readers who want extra assurance, using a privacy-first encrypted DNS service such as AEU DNS (https://aeu-dns.com) means you are relying on a provider that prioritizes encryption and certificate validation, helping to protect against impostor servers. Enabling DoH or DoT on your devices and keeping your software updated are practical steps to maintain a trusted connection.