Google says attackers altered authoritative DNS records during recent hijacks of the .gh, .sl and .as country-code top-level domain registries, obtaining unauthorized HTTPS certificates for several Google domains and domains belonging to other organizations. Google blocked the certificates in Chrome and worked with certificate authorities on revocation.
The incident illustrates a hard lesson in certificate lifecycle security: a valid certificate is not necessarily a trustworthy signal when an attacker controls the DNS validation path. Google says certificate authorities were not at fault for issuing the certificates under the circumstances.
Organizations with domains in the affected namespaces should review Certificate Transparency logs, confirm authoritative DNS control and publish restrictive CAA records. Google notes that restrictive CAA policies can help prevent an attacker from reusing cached domain-control validation after a registry-level hijack has ended.