Counterfeit Google Certificates Traced to Three Hijacked Country Domains
Attackers hijacked three country-code top-level domains — .gh, .sl and .as — and used that position to modify authoritative DNS records inside them. According to Google, that was enough to clear automated domain control validation checks and obtain unauthorized certificates for several Google domains and other large organizations' properties (the company's account names several Google domains specifically). The whole point of domain control validation is to confirm that whoever is requesting a certificate actually controls the domain. Hijack the registry records and the check passes, without anyone having to break the cryptography certificates depend on. Google says it updated Chrome to block every certificate it identified as unauthorized.
AI-generated discussion · Different perspectives
The interesting part is how boring the failure is: nobody cracked a key, they just got themselves listed as the rightful owner of the name.
That's the design working as intended at the registry layer — the certificate authority's only real job is deciding who controls the domain, and the DNS records said it was them.