Free tools Windows power users keep installed
One-click scans. No signup required.
Yes. If attackers compromise a country-code top-level domain (ccTLD) registry and alter authoritative DNS for selected domains, they may be able to satisfy a certificate authority’s domain-control checks and obtain trusted TLS certificates for domains they do not own. Google reported that attackers compromised the .gh, .sl and .as registries, changed DNS records and obtained unauthorized certificates covering some Google and other organizations’ domains. Google said its own systems were not compromised.
What happened in the .gh, .sl and .as incident?
In an account published October 6, 2026, Google’s Chrome Secure Web and Networking Team said attackers compromised the third-party registries for .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa). They changed authoritative DNS records for selected domains and obtained unauthorized HTTPS certificates for several Google domains and domains belonging to other organizations.
As an Amazon Associate I earn from qualifying purchases.
The public account confirms the registry compromise, DNS changes and certificate issuance. It does not provide a complete list of affected domains or certificates, a total count, or a timeline for each certificate. It also does not confirm that the certificates were used to intercept traffic or otherwise exploit users. Issuance is serious, but it is not evidence by itself that a certificate was used maliciously.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How can a DNS hijack result in a certificate?
Certificate authorities (CAs) generally require evidence that someone requesting a certificate controls the domain. DNS can be part of that evidence. A registry controls important parts of how domains in its namespace are delegated and resolved; if attackers can alter authoritative DNS records for a domain, they may be able to manipulate the DNS evidence used during domain-control validation. A CA may then issue a certificate that browsers trust, even though the requester is not the legitimate domain owner.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Google’s public account does not identify the validation method used for each certificate. It therefore does not establish that a particular ACME challenge or other specific validation procedure was used.
What a trusted certificate does—and does not—mean
A valid certificate can make an attacker-controlled endpoint appear to have a legitimate TLS certificate for the named domain. That can remove a browser certificate warning if traffic is also directed to the attacker’s endpoint. But certificate issuance alone does not redirect traffic, prove that interception occurred, or establish that users’ data was exposed. Those outcomes depend on additional conditions that Google’s account does not confirm.
What Google did, and where browser defenses stop
Google said it used Chrome CRLSets to block unauthorized certificates for its own properties and worked with issuing CAs to revoke certificates for other clients. It also used Certificate Transparency (CT) data to identify additional organizations it believed might be affected.
These actions are useful response layers, not a guarantee that every affected domain is protected. Google cautioned that its investigation may not identify every affected domain and that Chrome-side measures do not reliably protect people using other browsers or clients. Revocation and browser blocking therefore should not replace domain owners’ own certificate monitoring.
Rank #3
How to check whether a certificate was issued for your domain
Use Certificate Transparency logs or a CT monitoring service to review certificates issued for every domain you control. Google describes CT monitoring as a near-real-time way to alert domain owners to certificate issuance. Include parked domains, regional ccTLD properties and domains that are easy to overlook; a dormant website can still have a certificate issued for its name.
- Inventory every domain. Include subdomains and domains held in .gh, .sl, .as or other regional namespaces, as well as parked properties and domains managed by separate teams.
- Review recent CT entries. Search for each domain and inspect the certificate’s names, issuer and validity dates. If your organization holds domains in .gh, .sl or .as, review recent entries for those names in particular.
- Verify unfamiliar certificates. Check whether the certificate and its issuer match an approved request or deployment. Treat an unrecognized certificate as an investigation trigger; CT visibility does not, by itself, prove that the certificate was used.
- Keep monitoring continuously. A one-time search only shows entries available at that moment. Configure ongoing alerts for all domains and route them to the team responsible for DNS and certificate response.
What domain owners should do after a suspected registry or DNS compromise
- Restore trusted DNS control first. Work with the relevant registry, registrar and DNS operator to secure account access and return authoritative records to approved values. Confirm control through an independent channel where possible.
- Investigate certificates and request revocation when warranted. Identify unauthorized CT entries, contact the issuing CA and follow its revocation process. Review DNS and account changes around the relevant period for signs of unauthorized access.
- Publish restrictive CAA records. Certification Authority Authorization (CAA) records identify which CAs may issue certificates for a domain. Where supported, restrict issuance to authorized CAs and bind issuance to authorized ACME accounts and validation methods.
- Recheck CAA after DNS control is restored. CAA is not a defense while an attacker controls the DNS evidence used for validation. After control returns, restrictive CAA can help prevent some new issuance that might otherwise reuse cached, completed domain-control validation.
- Maintain CT alerts as an owner-side control. Browser intervention and CA revocation can reduce risk, but neither guarantees that every affected domain or client is covered.
Why this is not the same as BGP route hijacking
This incident involved compromise of ccTLD registries and changes to authoritative DNS records. It should not be described as a BGP route hijack. BGP route hijacking means an accidental or malicious alteration of an intended network route; route-origin validation using RPKI can mitigate some routing misconfigurations and malicious route announcements. It does not directly secure a compromised domain registry or restore authoritative DNS integrity.
Quick Recap
Best Value
Rank #4
- Tamper Resistant Star Key Set Crafted with premium chrome vanadium steel, and each star tool folds neatly into the handle for quick, easy access.
- Details - The handle is engraved with size for quick identification with drilled tips to allow use.
- Portable - Keys fold compact for easy storage, Drilled tips allow use on tamper resistant security screws.
- Size:Full Size T-6, T-7, T-8, T-9, T-10, T-15 T-20, T-25, T-27 and T-30.
- And with 10 total star sizes able to match nearly all standard tamper resistant security screws on the market.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →
