Cloudflare aims to make HTTPS certs safe from Border Gateway Protocol hijacking attacks with a new free service called “multipath domain control validation”
Dan Goodin / Ars Technica :
Context & Ripple Effects
This move extends a defense-in-depth arc Cloudflare had already started: a year earlier it began rolling out resource public key infrastructure to all customers to stop route leaks and hijacks at the routing layer. Multipath domain control validation attacks the same problem one layer up — the moment a certificate authority checks who controls a domain — where researchers had shown attackers could redirect traffic to fraudulently pass validation.
The free-delivery model echoes earlier shared-security infrastructure like the Quad9 DNS service from Global Cyber Alliance, IBM, and Packet Clearing House, positioning Cloudflare as a provider of baseline internet security rather than a paid add-on vendor.
First-order effects
- Certificate authorities and site operators gain a no-cost way to confirm domain control across multiple network paths, closing the BGP-hijack vector that lets an attacker impersonate a domain long enough to obtain a legitimate-looking HTTPS certificate.
Second-order effects
- Other certificate authorities face pressure to adopt multipath validation or explain why their issuance process still trusts a single, hijackable route — the same public-accountability dynamic Cloudflare later sharpened with its Is BGP Safe Yet checker that grades ISPs on routing protections.
Third-order effects
- If the pattern holds, web PKI security stops depending on any single layer: route validation (RPKI), multipath certificate checks, and ISP filtering stack together, and laggards at any layer become the identifiable weak link — with free tooling turning routing hygiene into a measurable, publicly comparable metric.
The trend: Internet trust infrastructure is shifting from single-path assumptions toward layered, independently verifiable checks — routing, certificates, and DNS each getting free tools that make weak operators visible.