Fina Root CA signs certificates for 1.1.1.1

#1

Post by JXzVB0iA » Mon, Sep 01, 2025, 5:23 AM UTC

Fina Root CA signs certificates for 1.1.1.1
crt.sh

Re: Fina Root CA signs certificates for 1.1.1.1

#2

Post by [deleted] » Mon, Sep 01, 2025, 5:23 AM UTC

[deleted]

Re: Fina Root CA signs certificates for 1.1.1.1

#3

Post by agwa » Wed, Sep 03, 2025, 12:31 PM UTC

This CA is trusted only by Microsoft. I and others have reported problematic CAs to Microsoft in the past (though this particular one wasn't on my radar) only for our concerns to be ignored. Mozilla, Chrome, and Apple have actual standards and don't trust CAs like this.

Re: Fina Root CA signs certificates for 1.1.1.1

#4

Post by mcgyver5152011 » Thu, Sep 04, 2025, 1:50 PM UTC

Should Cloudflare have been monitoring CT logs to spot this earlier?

Re: Fina Root CA signs certificates for 1.1.1.1

#5

Post by bwesterb » Thu, Sep 04, 2025, 6:10 PM UTC

mcgyver5152011 wrote: post #4

Should Cloudflare have been monitoring CT logs to spot this earlier?

We definitely should have, and that is on us. We'll fix it. https://blog.cloudflare.com/unauthorized-issuance-of-certifi...

Re: Fina Root CA signs certificates for 1.1.1.1

#6

Post by bwesterb » Thu, Sep 04, 2025, 6:12 PM UTC

agwa wrote: post #3

This CA is trusted only by Microsoft. I and others have reported problematic CAs to Microsoft in the past (though this particular one wasn't on my radar) only for our concerns to be ignored. Mozilla, Chrome, and Apple have actual standards and don't trust CAs like this.

It's also trusted as an EU Trust Service Provider. https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/... That's basically QWACS. Ah, of course you mentioned it in the other thread!