The number of mis-issued 1.1.1.1 certificates grows. Here’s the latest.

A recent incident involving the mis-issuance of TLS certificates for Cloudflare’s 1.1.1.1 encrypted DNS service has sparked significant alarm among cybersecurity experts. This situation raised fears that a potentially unidentified entity might possess the means to decrypt a vast number of encrypted DNS queries, which could lead to unauthorized access to users’ data. The discovery on Wednesday revealed that not just three, but a total of twelve mis-issued certificates had been identified, including nine more than were initially reported. These certificates, which could have allowed malicious actors to intercept or manipulate DNS queries, were deemed a severe security breach by Cloudflare, who attributed the oversight to Fina CA, the certificate authority responsible for the mishap. Cloudflare has since revoked all twelve certificates but stated that, so far, there is no evidence indicating that they were exploited maliciously. Following the discovery, an internal audit revealed the extent of the issue and underscored the need for stricter oversight in the certificate issuance process. Fina CA acknowledged the error, explaining that the certificates were mistakenly issued during an internal testing phase due to incorrect IP address entries. They emphasized that the mis-issued certificates were logged in accordance with standard procedures, which unfortunately led to this security lapse. Cloudflare has expressed regret over not detecting and addressing the problem sooner, highlighting the importance of the Certificate Transparency program that they help oversee.