Cybersecurity experts are raising serious concerns over the issuance of three improperly issued TLS certificates for the popular DNS resolver 1.1.1.1, operated by Cloudflare, in partnership with the Asia Pacific Network Information Centre (APNIC). These certificates, issued in May, could potentially compromise the privacy and security of millions of users worldwide.

These certificates enable the decryption of DNS over HTTPS (DoH) traffic, a protocol designed to enhance user privacy by encrypting DNS queries. If exploited, malicious actors could intercept or manipulate domain lookup data, undermining the integrity of encrypted communications. Of particular concern is the possibility that these certificates could be used to support other sensitive services, such as Cloudflare’s WARP VPN, further risking user privacy and data security.

Discovery and Implications of the Certificate Issue

The certificates came to light publicly only recently, following their discovery on an online discussion forum. They were issued by Fina RDC 2020, a subordinate authority under Fina Root CA, which itself is recognized by the Microsoft Root Certificate Program—meaning Windows-based systems trust these certificates by default. With Microsoft Edge capturing around 5% of global browser usage, the potential impact is significant, as it could enable widespread interception or impersonation of DNS requests.

While the certificates remain valid, their issuance highlights vulnerabilities in the current certificate authority (CA) ecosystem, emphasizing the importance of rigorous vetting and monitoring processes to prevent such lapses. Security experts warn that if these certificates are exploited, they could facilitate man-in-the-middle attacks, compromising both DNS privacy and the security of services relying on them.

Next Steps and Recommendations

Authorities and affected organizations are urged to revoke these certificates promptly and review their issuance policies. Users should stay updated through official security advisories and consider employing additional security measures, such as DNSSEC, to safeguard their DNS traffic. For detailed guidance on managing digital certificates and enhancing DNS security, consult resources like the Internet Engineering Task Force (IETF) documentation and the official Cloudflare security blog.

Ethan Cole

I'm Ethan Cole, a tech journalist with a passion for uncovering the stories behind innovation. I write about emerging technologies, startups, and the digital trends shaping our future. Read me on x.com