Yes, I should have been a lot clearer before throwing out an accusation like that. What I meant to say is that to the best of my knowledge I'm not using any of their services directly. The first thing I suspected was that Porkbun, my registrar and NS provider, requested them on my behalf for some service they offer. This would still be odd, as I do not recall ever using any of their services that would require this either, and their support stated that they don't recognize the certs.

My main gripe with Cloudflare is not that they issued these certificates. It's the fact that they are valid for one(1) year and I don't have an easy, preferably automated way to have them revoked.

Looks like porkbuns DNS runs on cloudflare: https://lowendspirit.com/discussion/4602/porkbun-ns-moving-t... https://kb.porkbun.com/article/216-how-to-enable-porkbuns-cl...

So it might have been a misconfiguration on porkbuns or cloudflares (or maybe a porkbun feature that requires the cloudflare cert) end that created a cert.

Seems like porkbun should be more clear about that using "their" DNS might lead to cloudflare issuing certs for those domains.

That would be the most likely scenario, yes.

I’ve just checked my domains hosted with Porkbun and it looks similar that Cloudflare has been issuing themselves certificates for my domains.

I do trust Cloudflare and Porkbun, but it does feel a little icky to happen without /any/ feedback or being informed.

I’d at least like to see the DNS entries in the Porkbun UI!