The browser blocked unauthorized HTTPS certificates after attackers took control of parts of three country-code domain systems. The affected namespaces were .gh for Ghana, .sl for Sierra Leone and .as for American Samoa, Google’s Chrome security team said October 6.
The attackers changed authoritative DNS records and obtained certificates for several Google domains and other organizations. DNS records tell the internet which servers handle a domain. An HTTPS certificate helps a browser confirm that it has reached the right site and encrypts the connection.
Google says the attacks did not compromise its own systems. Chrome used its CRLSet system to block certificates tied to Google properties, then acted on additional certificates found in public Certificate Transparency logs. Those logs record certificates issued for websites. Google also worked with certificate authorities to revoke affected certificates, which helps browsers beyond Chrome reject them.
The company says Chrome users did not need to take action. It cannot guarantee that it identified every affected domain, and browser blocks do not reliably protect people using other browsers. Google advised operators of the three domain endings to check certificate logs and restrict which authorities can issue certificates for their sites.
A valid certificate alone cannot protect a domain whose DNS control has been stolen. The attack crossed both systems.
