DNS Hijacks Enabled Unauthorized HTTPS Certificates for Google Domains
Summary
Attackers hijacked DNS records for the .gh, .sl and .as domains to obtain at least 12 unauthorized certificates for Google and YouTube names. Google blocked certificates in Chrome and worked with CAs to revoke them; no misuse was confirmed.
Key points
- At least 12 domain-validated certificates were issued for seven Google and YouTube domains after DNS records for .gh, .sl and .as were hijacked.
- Certificate Transparency records show Let's Encrypt issued 11 certificates and ZeroSSL issued one between September 22 and 27.
- Google said its own systems were not breached and did not report evidence that the certificates were used to impersonate sites or access user data.
- Google blocked the certificates it identified in Chrome and contacted affected organizations; all 12 certificates were listed as revoked by October 7.
- The attackers and the method used to compromise the ccTLDs were not identified, and Google said it could not guarantee every affected domain had been found.
- Google advised domain owners to use strict CAA records after regaining DNS control; Chrome's protections do not reliably cover users of other browsers.
Article Details
- Victim Organization
- Incident Type
- DNS hijacking used to obtain unauthorized domain-validated HTTPS certificates for Google and YouTube domains under the .gh, .sl, and .as ccTLDs.
- Disclosure Date
- 2026-10-06
- Operational Impact
- Twelve unauthorized certificates for seven domains were issued and later revoked. Chrome blocked the certificates Google identified. The article does not establish that any certificate was used to impersonate a site or access user data.
- Claim Status
- confirmed
People
Vendors
Google Trust Servicesleast September 10, every other certificate for google.com.gh, google.sl and google.as came from Google Trust Services, Google's own CA.Let's EncryptThe Hacker News found the certificates on October 7 through two CT search services, ctlogs.dev and Cert Spotter. The 12 certificates are for seven domains. Let's Encrypt issued 11 of them and ZeroSSL issued one.ZeroSSLThe Hacker News found the certificates on October 7 through two CT search services, ctlogs.dev and Cert Spotter. The 12 certificates are for seven domains. Let's Encrypt issued 11 of them and ZeroSSL issued one.
Products
Google ChromeChrome blocked the unauthorized certificates for Google's domains through CRLSets, its way of quickly blocking certificates in emergencies, Google said. The company also worked with the certificate authorities (CAs)Google Public DNSEach of the seven domains carried a strict CAA record on October 7. Google Public DNS returned a record naming only pki.goog, the domain of Google Trust Services, for every one of them.
Countries
American Samoaown systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an encryptedGhanaGoogle's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over anSierra LeoneGoogle's own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra Leone) or .as (American Samoa) was put at risk. With such a certificate, an attacker could pose as the real site over an