Hackers exploited .gh, .sl, and .as domain registries to forge valid TLS certificates for Google and global brands, bypassing standard security checks.

The fundamental trust mechanism of the modern internet has been bypassed in a sophisticated operation that targeted the periphery of the global domain system to strike at its center. Google recently confirmed that attackers managed to obtain unauthorized Transport Layer Security (TLS) certificates for several of its domains, as well as those of other leading global brands and widely used online services. The breach did not occur through a failure of Google's own internal security, but through the compromise of three country-code top-level domain (ccTLD) registries.

The vulnerability of the .gh, .sl, and .as registries

The attackers focused their efforts on the registries managing the domains for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as). By gaining control over these specific registries, the hackers were able to modify authoritative DNS records and name server delegations for selected domains within those namespaces. This strategic move allowed them to redirect traffic and, more importantly, manipulate the signals that the rest of the internet uses to verify identity.

Once the attackers held the keys to these national registries, they could alter the IP addresses of chosen sites. This level of control effectively turned these small national domains into gateways for a much larger impersonation campaign. By controlling the DNS records, the attackers could successfully pass the automated domain control validation checks required by certificate authorities (CAs) to issue a TLS certificate.

How the chain of trust was bypassed

A TLS certificate acts as a digital passport, binding a domain name to a public key through a digital signature. When a user visits a site, the browser checks this certificate to ensure the connection is genuine and not an impostor. For a CA to issue such a certificate, it must first verify that the requester actually controls the domain in question. This is typically done via an automated check of the DNS records.

In this instance, the certificate authorities followed every established rule. The validation process worked exactly as designed; however, the DNS records being queried were no longer under the control of the legitimate domain owners. Because the attackers had hijacked the registries, they could provide the exact answers the CAs expected, leading the authorities to issue real, browser-trusted certificates to unauthorized parties. As noted by Ars Technica, this allowed hackers to essentially walk away with cryptographic credentials for some of the most visited services on earth.

Google's response and the Chrome update

Upon discovering the impersonation, Google took immediate action to mitigate the risk to its users. The company updated the Chrome browser to block all unauthorized certificates it could identify. Simultaneously, Google coordinated with the issuing certificate authorities to ensure that the counterfeit certificates for its properties were revoked, rendering them useless for future attacks.

Despite these efforts, the cleanup process remains incomplete. Google has been transparent about the limitations of its analysis, admitting that it cannot guarantee every affected domain has been found. The complexity of DNS hijacks makes it difficult to trace every single certificate that may have been minted during the window of compromise. Furthermore, Google has not publicly disclosed which specific domains were targeted or named the other global brands caught in the crossfire.

The systemic flaw in domain validation

This incident exposes a critical weakness in the industry standard for domain validation. The current system proves that a requester controls a domain at the specific moment of the check, but it does not verify if that person should control it. The trust is placed entirely on the DNS record, which, as this attack proves, can be compromised at the registry level.

The infrastructure of the targeted domains' owners was not compromised. And the certificate authorities met all of their obligations. No rule was broken during issuance: validation worked as designed, but on DNS that was no longer in its owners' hands.

For enterprises, this means that even if their own servers are impenetrable, they are still vulnerable to failures in the third-party infrastructure that manages the global naming system. The reliance on a few centralized registries for national domains creates a single point of failure that can be exploited to impersonate any brand, regardless of that brand's own security posture.

Unanswered questions and remaining risks

While the immediate threat to Google users has been largely neutralized via browser updates, the broader implications for the global market remain. Several key questions persist: exactly how many certificates were issued across all affected brands, and whether the certificates targeting non-Google entities have been successfully blocked by other browser vendors.

The risk is particularly acute for high-value targets. As highlighted by Startup Fortune, the ability to forge trusted certificates is a nightmare scenario for entities such as banks, cryptocurrency exchanges, and enterprise SaaS platforms. If an attacker can present a valid TLS certificate, they can conduct man-in-the-middle attacks that are virtually undetectable to the average user or even some automated security tools.

Global implications for US and UK enterprises

For business leaders in the USA, UK, and other global markets, this event serves as a warning that perimeter security is insufficient if the underlying trust architecture is flawed. In the US and UK, where digital services are heavily integrated into financial and governmental infrastructure, the reliance on the current CA/Browser Forum standards may be a liability.

While there is no specific new regulation triggered by this event, it underscores the need for enterprises to move toward more robust verification methods. This includes the adoption of Certificate Transparency (CT) logs, which allow companies to monitor for certificates issued in their name in real-time. For UK and US firms operating globally, the lesson is clear: monitoring your own servers is not enough. You must also monitor the global certificate ecosystem to detect unauthorized issuances before they can be used in an attack.

The incident also highlights the geopolitical risk associated with ccTLDs. Companies that use national domains for localized marketing or operations are now aware that the security of those domains is only as strong as the registry of that specific country. For global firms, diversifying domain portfolios and implementing strict monitoring of DNS health is no longer optional, but a core requirement of business continuity planning.

FAQ

---

Sources: Arstechnica, Inyourgeek, Startupfortune ·