Google says attackers hijacked the third-party registries for .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa), changed authoritative DNS records, and obtained unauthorized HTTPS certificates for several Google domains and other organizations. Chrome blocked certificates it identified, while Google worked with issuing certificate authorities to revoke affected certificates for users of other clients. Chrome users do not need to take action to receive Chrome’s stated protection; domain owners should check certificate transparency logs and restore restrictive CAA policies after regaining DNS control.
What happened in the .gh, .sl and .as registry hijacks?
The Chrome Secure Web and Networking Team reported a series of hijacks involving the third-party registries for the .gh, .sl and .as country-code top-level domains (ccTLDs). Attackers changed authoritative DNS records, creating a path to obtain unauthorized HTTPS certificates for several Google properties and domains belonging to other organizations. Google says the incidents did not involve a compromise of its own systems and that it has no reason to believe the issuing certificate authorities acted improperly. Google Security Blog, October 6, 2026.
As an Amazon Associate I earn from qualifying purchases.
Changing authoritative DNS can undermine the domain-control checks used in certificate issuance. The resulting risk was not limited to Google: domains under the affected ccTLDs were at risk during the incidents. Google has not published counts of certificates, domains, organizations or users affected, so the scale should not be expressed as a numerical estimate.
How did Chrome respond?
Chrome blocked unauthorized certificates for Google properties through CRLSets, which Chrome uses to distribute certificate revocation information. As incident response continued, Certificate Transparency (CT) log data surfaced additional potentially affected organizations. Chrome proactively blocked more certificates, and Google says it contacted affected organizations where possible. Separately, Google worked with the issuing CAs to revoke affected certificates, a step intended to help users of browsers and other clients beyond Chrome. Google Security Blog.
#1 Best Overall
These are distinct layers of response: Chrome-side blocks can protect Chrome users against certificates it identifies; CA revocation can help clients that honor the revocation; CT monitoring helps domain owners detect unexpected issuance. None should be treated as a replacement for the others.
What should Chrome users do?
For this incident, Google says Chrome users do not need to take any action to receive Chrome’s protection. If Chrome displays a dangerous-site warning, follow Chrome’s general guidance and do not visit the page. Google Chrome Help: Manage warnings about unsafe sites.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Chrome’s intervention is not a guarantee that every affected certificate or domain will be detected, nor does it reliably protect people using non-Chrome clients. Treat an unexpected certificate warning as a reason to stop and verify the site through a trusted channel rather than bypassing the warning.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should domain owners do?
Monitor certificate issuance across the whole portfolio
Maintain ongoing monitoring of CT logs for every domain you control, including parked names and regional ccTLD properties. If you operate .gh, .sl or .as domains, review recent CT entries for certificates you did not authorize. Check the issuer, the names covered by each certificate, and whether the issuance matches a known deployment or certificate-renewal process. Google notes its incident analysis may not identify every affected domain; owners are best positioned to know which certificates and CAs are legitimate for their namespaces. Google Security Blog.
Restore restrictive CAA controls once DNS is secure
After confirming that you have regained control of authoritative DNS, review your Certification Authority Authorization (CAA) records and restore a restrictive policy that names only the CAs you authorize. Google also highlights restricting issuance to authorized ACME accounts and permitted domain-control-validation methods where supported. CAA is not a defense while an attacker controls DNS: an attacker with DNS control can change the records. Once control is restored, a restrictive policy can help prevent some further issuance, including issuance that might otherwise rely on cached domain-control-validation state. Google Security Blog.
Coordinate remediation with the registry and certificate issuer
If you discover an unauthorized certificate or suspect a registry-level DNS change, verify authoritative DNS control first, then work with the relevant registry or registrar and the certificate’s issuing CA to address the incident and request revocation where appropriate. Preserve the certificate details and timestamps from CT records so responders can identify the issuance. Do not assume a browser block has removed the certificate or corrected the DNS records.
Quick Recap
What Chrome’s response does—and does not—establish
- Established: Google reported registry hijacks affecting .gh, .sl and .as, unauthorized HTTPS certificate issuance, Chrome blocking certificates it identified, and coordination with issuing CAs on revocation.
- Not established: The public incident post gives no total for affected certificates, domains, organizations or users, and does not claim Chrome identified every affected domain.
- Practical implication: Chrome’s browser-side mitigation is useful, but domain owners remain responsible for monitoring their certificate issuance and protecting DNS control.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
