(8 votes, average: 4.63 out of 5)
Loading...
When you type a website into your browser, you assume your connection is private. That no one’s peeking over your shoulder. That’s the entire promise of TLS certificates.
But what happens when that promise is broken? That’s exactly what went down with Cloudflare’s 1.1.1.1 DNS service, one of the most trusted DNS resolvers on the planet. Unauthorised TLS certificates were issued for it. And yes, that’s as bad as it sounds.
Between February 2024 and August 2025, a Croatian certificate authority called Fina CA issued twelve unauthorised rogue TLS certificates for Cloudflare’s 1.1.1.1 resolver. Cloudflare never requested them. They weren’t authorised.
These rogue certificates meant attackers could have impersonated 1.1.1.1, intercepted encrypted DNS queries, and decrypted users’ browsing activity.
Yet, for over a year, these fake certificates existed fully trusted by Microsoft’s root certificate store. That means if you were using Windows or Microsoft Edge, an attacker could have:
- Impersonated 1.1.1.1
- Intercepted your DNS queries
- Decrypted what you thought was private browsing traffic
1.1.1.1 is supposed to be one of the most secure, privacy-first DNS services. Millions of people use it precisely because they want to keep their traffic away from snooping eyes.
Why TLS Certificates Are the Internet’s “Proof of Identity”
When you visit a website, say, https://bank.com, your browser doesn’t just trust it blindly. It asks for proof of a TLS certificate.
That certificate is like an official passport. It says:
- “Yes, I really am bank.com.”
- “Yes, your data will be encrypted.”
- “Yes, you can trust me.”
Who issues these passports? Certificate Authorities (CAs). If even one CA goes rogue or makes a mistake, attackers can impersonate any site. This isn’t theory. It’s happened before.
Why 1.1.1.1 Is So Important?
If you don’t know, 1.1.1.1 is Cloudflare’s public DNS resolver, built in partnership with APNIC. Millions of people use it every single day because it’s fast, private, and secure.
DNS is the phonebook of the Internet. Every time you visit Google, YouTube, or your bank, your device asks a DNS resolver to translate the name into an IP address. That is happening on one of the world’s most popular resolvers.
If that lookup is compromised, attackers can:
- Steal your browsing history
- Redirect you to fake websites
- Insert malicious code into your traffic
Also Read: Decoy Dog Malware Toolkit uncovered after analyzing 70 billion DNS Requests
Who Was at Risk?
Here is where it becomes interesting. Microsoft had trust in the Fina CA certificates in its root store. That is to say that Windows and Microsoft Edge users were in the danger zone.
But Chrome, Firefox and Safari? Safe. Why? The reason is that they never trusted Fina to begin with.
How Cloudflare Responded?
And to their credit, Cloudflare acted very quickly after this was published on September 3, 2025.
They:
- Researched the extent of the problem.
- The rogue certificates were confirmed revoked.
- Contacted Microsoft, Fina, and EU regulators
- Reassured users that their WARP VPN was unaffected
- They indeed ought to have noticed it earlier.
Nevertheless, Cloudflare also confessed something most companies would not: they have failed to monitor their own certificate transparency warnings.
What Businesses and Users Should Do Next?
When something like this happens, people immediately ask What should I do? The answer depends on who you are.
If you’re running IT for a company, the biggest mistake is assuming the defaults are enough. Don’t just trust whatever your operating system trusts. Audit your certificate authorities. Run your own monitoring with Certificate Transparency logs, crt.sh, and Google’s CertSpotter exist for a reason.
TLS isn’t the whole story. Add layers, like DNSSEC and active monitoring, because no single defence is perfect.
If you’re a developer or service owner, think of it as part of your job to automate paranoia. Don’t rely on manual checks; wire certificate monitoring into your CI/CD. Expect revocations to happen and make sure your systems respect them. And don’t put all your trust in one CA’s redundancy isn’t overkill, it’s survival.
If you are a simple user, the recommendation is not more complex and no less significant. Always update your OS, since the revocation lists can be effective only when your system is aware of their existence.
Use browsers such as Chrome or Firefox that have a tendency to be more critical of CAs. And when your browser has an option to enable DNS over HTTPS, enable it. It is even more difficult to have someone in the middle view or interfere with your traffic.
Conclusion
The Cloudflare 1.1.1.1 incident is a reminder that trust on the internet is fragile. A single mistake by one certificate authority was enough to put millions of users at risk for more than a year. The lesson is simple. Don’t assume someone else is watching your back.
Whether you’re a business protecting customers or a user safeguarding your privacy, certificate transparency, layered defences, and proactive monitoring aren’t optional; they’re survival.
If you want expert guidance on securing your infrastructure against threats like this, contact us for cybersecurity services and consulting.
