Attackers Hijack Ghana, Sierra Leone, Samoa Domain Registries for Google Certs

On October 6 Google announced that attackers compromised the registries for.gh,.sl and.as and obtained unauthorized HTTPS certificates for several Google domains. Google's own systems were not breached, but any domain ending in.gh,.sl or.as was at risk because an attacker could now present a valid certificate to browsers when users visited those sites over an encrypted connection.¹

The new certificates allow an adversary to pose as the legitimate site without triggering browser warnings, since they appear signed by a trusted CA. Browsers will flag such misuse only once the CA’s root program revokes offending keys—a process that can take days or weeks depending on the CA’s procedures.¹

Security experts note this attack exploits the inherent trust placed in root CAs by web browsers. By forging AS‑signed keys from these registries—some state owned, like Ghana’s registry—the attackers bypassed standard TLS/HTTPS handshakes. Similar incidents have occurred before: DigiNotar’s fraudulent issuance of SSL certificates between 2011–2013 targeted Iranian government websites; Estonian domains were hijacked in 2015; Ukrainian infrastructure (.ua) suffered comparable attacks in 2017. These cases demonstrate that even well‑defended systems remain vulnerable if they rely on third parties whose security practices are untrusted or compromised.