← Wednesday, October 7, 2026SecurityNews

Attackers hijacked three country domains to obtain counterfeit TLS certificates

arstechnica.com 3 min read Editor score 7/10

Control of the .gh, .sl and .as domains let attackers alter DNS records, pass domain-control checks and obtain unauthorized certificates for major services. The incident highlights how weaknesses in domain administration can threaten the certificate trust chain.

What: Attackers hijacked the .gh, .sl, and .as country-code domains and used them to obtain counterfeit TLS certificates for major services.
How: They changed authoritative DNS records to pass domain-control checks; Google blocked identified certificates in Chrome and worked with authorities on revocation.
Why it matters: Domain owners are advised to monitor certificate transparency logs and publish restrictive CAA records, since browser-side blocking may not protect everyone.

Control of ccTLDs enabled DNS changes that passed validation and led to unauthorized certificates. Sketched from the article's own text.

Read on arstechnica.com → Hacker News · 6 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.