A sophisticated cyber incident has exposed vulnerabilities in the global domain name system after attackers successfully compromised three country-code top-level domains (ccTLDs). The breach allowed unauthorized entities to obtain fraudulent HTTPS certificates for several high-profile Google and YouTube domains. Google disclosed the security incident, noting that while its own internal infrastructure and systems remained entirely unbreached, any web traffic directed through the affected country-code extensions was placed at severe risk.
The compromised top-level domains involved in the incident were .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. By acquiring valid cryptographic certificates for domains under these jurisdictions, malicious actors could theoretically execute advanced man-in-the-middle attacks. With such a certificate, an attacker would be capable of masquerading as a legitimate website over an encrypted HTTPS connection, potentially allowing them to intercept, read, or manipulate private data transmitted by unsuspecting users.
Upon discovering the unauthorized activity, Google moved swiftly to mitigate the threat. The company utilized CRLSets—its specialized emergency mechanism within the Chrome browser designed to rapidly block compromised or fraudulent certificates. By pushing these immediate updates, Chrome effectively blocked the unauthorized certificates for Google’s domains. Simultaneously, Google collaborated directly with the third-party certificate authorities (CAs) that originally issued the documents to ensure their immediate revocation, providing a crucial layer of defense for individuals using alternative web browsers and client applications.
While Google did not initially disclose the exact list of affected domains in its public advisory, public records maintained within Certificate Transparency (CT) logs shed light on the scope of the attack. Certificate Transparency logs serve as a public, append-only ledger recording every TLS/SSL certificate issued by participating certificate authorities. Analysis of these public logs revealed at least 12 distinct certificates issued between September 22 and September 27 for various Google and YouTube properties operating under the compromised ccTLDs, including specific names such as google.com.gh, google.sl, and google.as.
Under standard web security protocols, a certificate authority issues an HTTPS certificate only after verifying that the applicant holds administrative control over the target domain, a process typically validated by requiring the applicant to add a specific DNS record or token. Investigators determined that the attackers achieved this verification by successfully manipulating authoritative DNS records during the registry hijacks. Consequently, security experts and Google alike have emphasized that the certificate authorities operated according to standard protocols and did not commit any procedural errors; they were simply presented with falsified validation signals stemming from the compromised domain registries.
What Certificate Logs Show
Security researchers discovered the fraudulent certificates using prominent CT search services, which revealed that Let’s Encrypt issued 11 of the 12 identified certificates, while ZeroSSL issued the remaining one. The digital paper trail recorded in the logs unfolded across three distinct days, correlating directly with the sequential compromise of individual ccTLD registries. The activity targeting the .gh domain was logged on September 22, followed by the .sl registry on September 25, and concluding with the .as registry on September 27.
All 12 of the discovered credentials were classified as domain-validated certificates, meaning they were generated following confirmation of domain control via standard automated checks. A retrospective review of historical issuance records—extending back to at least September 10—revealed that legitimate prior certificates for properties like google.com.gh, google.sl, and google.as were consistently issued by Google Trust Services, Google’s proprietary certificate authority. The sudden appearance of third-party issuers like Let’s Encrypt and ZeroSSL for these specific institutional domains served as an immediate red flag for security monitors.
Representatives from the affected certificate authorities acknowledged the situation promptly. A staff member for Let’s Encrypt confirmed on the organization’s community forum that certificates for Google and YouTube assets had indeed been issued during the window of the registry hijacks and that all associated credentials had subsequently been revoked.
Because the initial scope of the security investigation focused primarily on a targeted set of Google and YouTube domain names, industry experts believe the true breadth of the campaign could be significantly larger. Data derived from Certificate Transparency logs strongly indicated that other prominent organizations, global brands, and widely utilized online services were similarly targeted during the same wave of registry attacks, though these entities have not been publicly identified by name.
What the Response Covers
Logs maintained by security monitoring services indicated that all 12 unauthorized certificates had been successfully revoked by early October. The certificates associated with the .gh domain, along with the single ZeroSSL credential, were invalidated on September 26, while the remaining nine certificates tied to the other registries were revoked on October 1. The duration between the initial logging of a fraudulent certificate and its eventual revocation ranged from roughly a day and a half to nearly a full week.
Google stated that it became aware of the domain hijacks during the week preceding its public disclosure and initiated mitigation efforts immediately. However, the company did not release a precise timeline detailing when the underlying registry compromises occurred or the exact moment its own internal monitoring flagged the anomalous certificate issuance. In addition to neutralizing the threat within its own ecosystem, Google blocked the rogue certificates discovered for other organizations within the Chrome browser and attempted to notify the impacted entities wherever feasible.
Reassuring its user base, Google noted that standard Chrome users are not required to take any manual action to maintain their security. At the same time, the company cautioned that domain owners should never rely solely on browser-level mitigations to protect their users from sophisticated infrastructure attacks. Because domain name system hijacks are inherently complex and multi-layered, the Chrome Secure Web and Networking Team emphasized that technical analyses cannot categorically guarantee the identification of every single affected domain, nor do browser blocks fully safeguard individuals utilizing competing web applications.
Google’s public advisory left several questions unanswered, omitting details regarding whether any of the fraudulent certificates were actively weaponized to impersonate legitimate Google properties or harvest user data. Furthermore, the company did not identify the threat actors responsible for the registry compromises, explain the exact vector used to breach the ccTLD registries, or confirm whether the underlying vulnerabilities at the registry level have been fully remediated.
What Domain Owners Should Do
To defend against similar sophisticated attacks, security guidance highlights the importance of implementing robust organizational defenses, particularly CAA (Certificate Authority Authorization) records. A CAA record is a DNS resource record that allows domain owners to declare which certificate authorities are explicitly authorized to issue certificates for their domains, thereby preventing unauthorized CAs from issuing credentials even if basic validation checks are bypassed.
Security analysts point out that while a CAA record cannot prevent an attacker from attempting to issue a certificate while an active DNS hijack is underway—since a determined attacker with temporary control of the DNS can simply remove or alter the CAA record—the mechanism becomes crucial once the rightful owner reclaims administrative control. Certificate authorities are permitted under current industry standards to reuse completed domain validation checks for subsequent certificate requests over a designated time period. This means an attacker who successfully passes validation during a brief hijack window could potentially request additional certificates long after the initial hijack has ended, unless a strict CAA record is enforced to block unauthorized issuers.
Under current baseline requirements established by the CA/Browser Forum, certificate authorities are permitted to reuse domain validation checks for up to 200 days. However, scheduled governance updates will progressively tighten this window, lowering the reuse limit to 100 days by March 2027 and down to 10 days by March 2029. Major certificate authorities are already moving to shorten these validation lifespans independently; Let’s Encrypt, for instance, operates with a 30-day reuse window and has outlined plans to reduce that threshold significantly in the coming years.
Security audits following the October incident confirmed that the targeted domains maintained strict CAA records, with public DNS resolution pointing exclusively to Google Trust Services’ proprietary authorization domain, reflecting a concerted effort by the tech giant to lock down its global domain portfolio against future registry-level exploitation.
