Google details DNS hijack of three ccTLDs for unauthorized certificates
Attackers hijacked the DNS for three country-code top-level domains to obtain 32 unauthorized HTTPS certificates for Google and other major organizations.
Google disclosed that attackers hijacked the DNS for three country-code top-level domains and obtained unauthorized certificates for Google and other organizations. The company's security team detailed the incident on Tuesday, October 6, in a post by its Chrome Secure Web and Networking Team. Attackers compromised the third-party operators of the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, changing authoritative DNS records to facilitate the fraud.
Between September 22 and 27, 32 unauthorized HTTPS certificates were issued. The attackers obtained wildcard certificates from Let’s Encrypt and Sectigo’s ZeroSSL service, and one certificate was issued through Cloudflare’s certificate authority for a domain linked to another major technology company. Most certificates were issued within about 90 minutes of each registry compromise.
| ccTLD | Country | Compromise Date |
|---|---|---|
| .gh | Ghana | September 22 |
| .sl | Sierra Leone | September 25 |
| .as | American Samoa | September 27 |
Google confirmed the incidents did not involve a breach of its own systems. Certificate Transparency log data revealed other organizations were hit, including several large global brands and popular online services.
Google's response and protections
Google blocked the unauthorized certificates for its own properties and other affected organizations in Chrome using its CRLSet mechanism. The company stated Chrome users do not need to take any action to be protected. Google also worked with the issuing certificate authorities to secure revocation of the certificates, which have since been revoked to protect users of other browsers and applications.
Despite these actions, Google warned that browser-side protections are insufficient. The company cautioned that its analysis may not have identified every affected domain, and such measures do not reliably protect non-Chrome users. Google said it contacted affected organizations where possible.
Recommendations for domain owners
Google recommended domain owners continuously monitor Certificate Transparency logs across their entire domain portfolios, including parked and regional ccTLD properties. Organizations operating .gh, .sl, or .as domains should review recent CT entries for unexpected certificate issuance.
The company advised deploying restrictive Certificate Authority Authorization records with ACME account bindings. Google noted that CAA records cannot necessarily prevent issuance during an active DNS hijack. However, restoring a restrictive CAA policy afterward can stop attackers from reusing cached domain-control validation checks to obtain new certificates.
Uncertainties and limitations
Google did not say who is behind the attacks or how the registries were compromised. The precise methods used to compromise the three ccTLD namespaces remain undisclosed. The company stated that due to the complexity of DNS hijacks, it cannot guarantee its analysis identified every affected domain.
The full inventory of affected domains, the extent of any resulting traffic interception, and registry-level incident timelines have not been established publicly. Google stated it had no reason to believe the certificate authorities that issued the affected certificates had acted improperly. The company said it will continue working on broader HTTPS ecosystem changes, including reducing certificate validity periods and the reuse of domain-control validation.
