There is some chatter about a CA mis-issuing a certificate for 1.1.1.1. https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/SgwC1QsEpvc/m/0V_VMV7uAgAJ
This CA (https://crt.sh/?caid=201916, only ~300 certs) is only trusted by (1) the Microsoft root program, and (2) the eIDAS QWAC trusted list.
MS has not been actively managing their root program for years now, and the EU wanted to push theirs on browsers with much better ones.
@filippo to me, it’s funny that this is not even the first mis-issuance related to 1.1.1.1 - there’s this banger: common name kasnetzise001.ka.de.dm-drogeriemarkt.com (???), valid for 2 years from 2013 to 2015, first seen by crt.sh in 2020 (??????). We tried investigating this last year as a part of our dns hyperfocus in Project SERVFAIL ( @dns ), but we never really got any interesting info.
If you filter crt.sh by in-addr.arpa, a surprising amount of certificates are issued for 1.1.1.1. Probably not to pwn cloudflare, rather as a placeholder that held the place for too long.
@filippo croatia has a foia [1]. It’s also available to foreigners, seems like an option to get some answers, or non-answers. Maybe @q would like another foia side-quest? Or someone else?
[1] https://en.wikipedia.org/wiki/Access_to_public_information_in_Croatia
@pft This is a weird time to call the opposition to QWACs FUD?
Like, this is exactly the kind of bad stuff we all said would happen.
@filippo I'm just calling that specific campaign FUD.
What happened here is IMO not worse than what happened to Google, Mozilla, and other trust stores in case of TrustCor or any other shady CA that made it into the program and was retracted later. Did anyone question the existence of trust stores?
My point is that the opposition from trust stores to EU is in bad faith and is about maintaining own power position.
I was getting SERVFAIL both from my local DNS server and from Google. So I am confident there was something wrong with the authoritative servers for the domain.
Now I am getting a different error though.
@kasperd that's really strange, the first screenshot says nx domain...
Anyhow, it's not that interesting after all.
It’s a known problem that there are browsers saying NXDOMAIN to the user for every DNS problem even if it’s not NXDOMAIN at all.
When I got that error at first I verified using the dig and host commands that it was a SERVFAIL error and that I also got that error from other DNS servers.
Filippo Valsorda
dmi đź’˝ 
Merlin (Unifi hater no. 1)
CraftByte
aurorus
NedĹľad Beus
Pontiff Fractal Tiam
kasperd