Hijacked .gh, .sl and .as Registries Enabled 12 Fake Google Certificates

Attackers compromised three country-code registries and used them to obtain unauthorized HTTPS certificates for Google and YouTube domains, showing that browser trust can fail outside the target company’s infrastructure. Google said its systems were not breached, but domains ending in .gh, .sl or .as were exposed to impersonation and encrypted traffic interception. Chrome blocked the certificates through CRLSets, while the issuing certificate authorities revoked them.

• The .gh, .sl and .as registries were hijacked, putting any domain under those suffixes at risk.
• Attackers obtained 12 unauthorized certificates for Google and YouTube domains.
• Google said its own systems were not breached; the exposure came through control of the registries and certificate issuance.
• Chrome used CRLSets to block the unauthorized Google certificates, and the issuing certificate authorities revoked them.
• The certificates could let attackers impersonate legitimate sites without the usual browser certificate warnings and read private data sent to them.

Bottom line If you operate domains under .gh, .sl or .as, audit their certificates and registry control immediately; otherwise, review how your clients respond to emergency certificate blocks.