EDITION OF OCTOBER 7, 2026
DNS hijacking enables attackers to obtain unauthorized TLS certificates
According to Google, attackers hijacked top-level domains to obtain TLS certificates targeting its services and other organizations. Chrome blocks the certificates identified, but the full scope remains unknown. The incident highlights certificate validation's dependence on control of DNS.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Control of DNS allowed attackers to obtain unauthorized TLS certificates, according to Google. The measures announced for Chrome reduce the identified risk, but their scope remains limited. This incident highlights the vulnerability of certificate validation when control of domains is hijacked.
Attackers hijacked the .gh, .sl and .as top-level domains to obtain unauthorized TLS certificates for Google services and other major organizations. Ars Technica reports this statement from Google. The dates of the attacks themselves are not specified. The number of certificates issued and the list of other affected organizations also remain unknown.
The mechanism described relies on control of DNS. The attackers modified authoritative records and name server delegations for certain domains. This allowed them to pass automated checks intended to establish that an applicant controls the domain for which they are requesting a certificate. According to Google, the certificate authorities complied with the applicable requirements, and the infrastructure belonging to the owners of the affected domains was not compromised.
TLS certificates associate a domain name with a public key and help authenticate Internet services. Obtaining an unauthorized certificate can therefore enable an attacker to impersonate the targeted infrastructure. Analysis of this incident reveals a specific limitation: validation based on domain control can be satisfied by an attacker who has hijacked that control. Compliance with the issuance procedure is then insufficient to establish the applicant's legitimacy.
Google says it has updated Chrome to block all certificates identified as unauthorized. The company also says it worked with the issuing authorities to revoke those concerning its own services. It specifies that Chrome users do not need to take any action to benefit from this protection. This response does not, however, provide a general guarantee: Google cannot be certain it has identified every affected domain, and the interventions in Chrome do not reliably protect users of other browsers.
For domain owners, Google recommends monitoring certificate transparency logs to identify unexpected issuance. The company also advises publishing restrictive DNS Certification Authority Authorization records, particularly to prevent the reuse of cached validation data after DNS control has been restored. The known risk has been reduced by the announced blocks, but the absence of a comprehensive inventory leaves open the question of certificates that may have escaped detection.