Google Discloses Counterfeit TLS Certificates After Attackers Hijacked Three Country‑Code Domain Registries

On Oct. 6, 2026, Google disclosed that attackers had obtained counterfeit TLS certificates for several of its domains and for other major online services after compromising three country‑code top‑level domain registries. The affected registries were Ghana’s .gh, Sierra Leone’s .sl and American Samoa’s .as, as reported by Ars Technica, Startup Fortune, daily.dev and the Technology data bank. Google said it detected the breach and reported it on a Tuesday, marking the first public acknowledgment of the incident.

The intruders altered authoritative DNS records for selected domains under the compromised registries, allowing them to meet the automated domain‑control validation checks that certificate authorities perform before issuing a certificate. By passing this check, they received unauthorized TLS certificates for Google properties and for a range of widely used online services, although Google has not disclosed the exact list of domains involved. This manipulation exploited the fact that domain validation only confirms momentary control of a domain and cannot distinguish a legitimate registrant from an attacker who has hijacked DNS upstream.

TLS certificates are digital credentials that bind a domain name to a public key using a cryptographic signature, enabling visitors to verify they are connecting to the authentic site rather than an impostor. The unauthorized certificates thus appeared valid to browsers that rely on the public‑key infrastructure, despite being issued without the domain owner’s consent. Google’s Chrome browser treats such certificates as untrusted once Google identifies them and adds them to its blocklist.

In response, Google updated its Chrome browser to block all counterfeit certificates it identified related to the incident, preventing users from establishing connections that would rely on the fraudulent credentials. It also coordinated with the issuing certificate authorities and other browser vendors to revoke the unauthorized certificates for Google properties across browsers, reducing the chance of accidental trust. Google took these actions shortly after the public disclosure on Oct. 6, 2026.

Google acknowledged that it cannot guarantee it has found every unauthorized certificate issued through the exploited validation weakness, leaving open the possibility that some fraudulent certificates remain undetected. The company has not publicly identified which of its own domains experienced impact, nor has it named the other organizations whose domains experienced impact, citing ongoing investigation constraints.

Google is advising domain owners to actively track Certificate Transparency logs for unexpected certificate issuance against their domains, rather than relying solely on browser‑side protections to catch mis‑issued certificates. It also recommends publishing restrictive Certification Authority Authorization (CAA) DNS records to prevent attackers from reusing cached validation data after legitimate owners restore DNS control.

Certificate Transparency logs are public, append‑only records that log every publicly trusted certificate, enabling domain owners to spot unauthorized issuance by searching for their own names. CAA records let domain owners restrict which certificate authorities are allowed to issue certificates for their domains, effectively blocking unauthorized CAs even if DNS validation is compromised. Together, these tools provide a defense‑in‑depth approach that complements browser‑side blocklists.

The incident is not isolated; history shows similar abuses of the DNS‑validation chain. In a prior case, attackers obtained a Let’s Encrypt certificate for google.tg after compromising Togo’s .tg registry, and Chrome’s hardcoded pinning for Google domains prevented browsers from accepting it.

In 2011, attackers forged a wildcard certificate for *.google.com in the DigiNotar breach and used it against Iranian internet users in activity that researchers assess as state‑sponsored surveillance; DigiNotar’s parent company filed for bankruptcy within weeks. Cisco Talos researchers have tracked a long‑running, state‑sponsored campaign nicknamed Sea Turtle that used stolen credentials to access DNS provider admin panels and mint certificates for hijacked domains across many ccTLD registries.

These events show that the trust underpinning HTTPS connections depends not only on the cryptography of certificate authorities but also on the security of domain registries far upstream. A compromise at a small, potentially under‑resourced ccTLD registry can let attackers forge certificates trusted by every major browser for high‑value targets like Google, undermining confidence in the encrypted web.

Defenders should track Certificate Transparency logs, keep browsers updated to the latest versions that include known fraudulent certificate blocklists, and consider implementing CAA records as part of their defensive posture. Looking ahead, security teams may watch for further alerts from ccTLD operators, updates to the CA/Browser Forum’s baseline requirements, and any further Google advisories about newly discovered counterfeit certificates. Continued vigilance on upstream DNS infrastructure remains essential to preserve the integrity of web trust and to prevent recurrence of similar trust‑abuse incidents.