{"id":183672,"date":"2026-10-07T22:54:13","date_gmt":"2026-10-07T20:54:13","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/komprometacziya-registratorov-3-domennyh-zon-pozvolila-poluchit-tls-sertifikaty-k-servisam-google"},"modified":"2026-10-07T22:54:20","modified_gmt":"2026-10-07T20:54:20","slug":"compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/compromise-of-registrars-for-three-domain-zones-enabled-tls-certificate-issuance-for-google-services","title":{"rendered":"The compromise of 3 domain registrars allowed the acquisition of TLS certificates for Google services.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Google has reported an incident in which attackers managed to obtain TLS certificates for certain Google domains (such as google.as), online services, and major companies in the zones «.gh», «.sl», and «.as». The attack was executed by compromising the registrars of national top-level domain zones \u2014 «.gh» (Ghana), «.sl» (Sierra Leone), and «.as» (American Samoa), allowing them to replace DNS servers for domains in these zones and redirect requests to the attackers' servers. By redirecting traffic, the attackers were able to confirm ownership of the domains and obtain TLS certificates, as after changing the data in the DNS, verification requests from certificate authorities were sent not to the real hosts but to the substituted ones and processed there. <\/p>\n
Unauthorized certificate issuance was discovered as a result of analyzing Certificate Transparency logs, in which certificate authorities reflect all issued and revoked certificates. Google blocked the illegitimate certificates obtained during the attack using the CRLSets mechanism in the Chrome browser and also succeeded in revoking these certificates from the certificate authorities. It is not yet revealed for which specific domains the fraudulent certificates were issued and which companies were affected by the attack. <\/p>\n
To minimize risks of similar incidents recurring, domain owners are advised to establish continuous monitoring of public CT (Certificate Transparency) logs to detect unauthorized certificate issuance. It's recommended to add CAA (Certification Authority Authorization) records in DNS, defining the list of certificate authorities authorized to issue certificates for the specified domain. Setting a CAA DNS record will not protect against certificate requests after DNS spoofing, but after regaining control over DNS, it will prevent the reissuing of certificates by attackers using cached domain ownership verification data. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"