Attackers obtained trusted HTTPS certificates for Google domains without breaching Google's systems. Instead, they compromised third-party domain registry infrastructure, exploiting a weakness in how website identities are verified.
In an October 6, 2026, disclosure, Google said attackers compromised infrastructure supporting three country-code domains: .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). By manipulating authoritative DNS records, they obtained unauthorized certificates for Google properties and other organizations. Google blocked identified certificates in Chrome and worked with issuing certificate authorities to revoke them.
The incident exposed a risk for enterprises operating regional websites. Compromised registry infrastructure can undermine certificate validation without requiring attackers to breach the affected organization's systems.
How attackers obtained unauthorized HTTPS certificates
Certificate authorities (CAs) issue publicly trusted HTTPS certificates after verifying that applicants control the relevant domains. Attackers who manipulate authoritative DNS records can satisfy those checks without permission from legitimate domain owners.
According to Google's security disclosure, the certificates were issued through established validation processes, but without authorization from the legitimate domain owners. Google said it had no reason to believe the issuing CAs acted improperly.
An investigation by The Hacker News identified 12 certificates covering seven Google and YouTube domain names between September 22 and 27. Eleven came from Let's Encrypt and one from ZeroSSL. Affected domains included google.com.gh, google.sl, and google.as.
All 12 had been revoked by October 7. A Let's Encrypt representative confirmed that certificates for Google and YouTube domains had been issued and revoked.
Google used Chrome's CRLSet mechanism to block unauthorized certificates it identified. Certificate Transparency (CT) logs revealed additional potentially affected organizations, prompting further blocking and notifications.
Google said Chrome users needed no additional action but warned that its browser protections might miss affected domains and could not reliably protect users of other browsers.
The certificates could have enabled website impersonation if attackers also redirected traffic. Google did not confirm that they were used to intercept communications or steal data.
What eWeek found: Registry hijacks expose limits of certificate controls
Restricting certificate issuers cannot guarantee protection when attackers control authoritative DNS. Google's findings expose a gap between enterprise certificate policies and the external infrastructure used to verify domain control.
Certificate Authority Authorization (CAA) records restrict which CAs may issue certificates. However, they cannot prevent issuance during an active DNS hijack. Let's Encrypt's technical documentation describes account-specific restrictions that, where supported, can provide additional protection after legitimate DNS control is restored.
CT monitoring serves a different function: detecting unexpected issuance after it occurs. The 12 certificates identified in public records demonstrate its investigative value, although the full extent of the compromises remains unresolved.
Certificate oversight also extends to infrastructure managed by cloud providers. Google Cloud's quantum-security roadmap examines how cryptographic migration responsibilities are divided between providers and customers.
Enterprises should monitor certificate issuance across regional and parked domains, enforce restrictive CAA policies, and establish procedures for investigating unexpected certificates. Recent CISA red-team assessments exposed separate detection and response weaknesses in critical infrastructure. Similarly, Microsoft's Defender updates for local AI agents address the distinct challenge of discovering assets outside established security inventories.
Google blocked the certificates it identified but could not guarantee that every affected domain was discovered. Enterprise certificate monitoring must therefore extend beyond internally managed infrastructure.
Read more: As cryptographic security requirements evolve, organizations also need to scrutinize quantum-ready hardware and its claimed security capabilities before treating vendor assurances as verified protections.