Domain Registrar Security Risks: ccTLD Registry Hijacks Enable Unauthorized Certificates

Recent compromises of ccTLD registry operators exposed weaknesses in domain registrar security. Attackers altered DNS records for domains under .gh, .sl, and .as between September 22 and 27, 2026, and obtained valid certificates from major CAs without touching Google infrastructure or the certificate authorities themselves.

The events demonstrate that control at the registry level bypasses standard domain-owner protections and allows attackers to pass automated domain-control validation checks. Google reported the incidents publicly on October 6 and blocked the certificates in Chrome via CRLSets.

Domain Registrar Security Implications of Registry-Level Attacks

Registry operators for .gh (Network Computer Systems), .sl (Sierratel), and .as (AS Domain Registry) suffered unauthorized changes to authoritative DNS records. This access enabled issuance of at least twelve unauthorized certificates covering seven Google and YouTube subdomains plus wildcards. Additional analysis of certificate transparency logs identified up to thirty-two certificates linked to the incidents across multiple organizations.

Standard protections such as DNSSEC and basic CAA records proved insufficient during the active hijack because the registry itself controls the DS records. Account-level registrar security measures, including multi-factor authentication and registrar locks, cannot prevent registry-level modifications. The attacks highlight that domain registrar security must extend beyond individual account protections to include monitoring of certificate transparency logs and restrictive CAA configurations with ACME account bindings.

Google stated that no evidence indicated compromise of its own systems or improper actions by the CAs. The company worked with Let’s Encrypt and ZeroSSL to revoke the certificates and urged domain owners to implement continuous CT monitoring and tighter validation restrictions. No statements have been issued by the affected registry operators regarding breach details or remediation steps.

Comparison of Affected ccTLDs and Certificate Activity

The three compromised registries differ in operator and scale, yet each allowed similar DNS manipulation. The table below summarizes key details of the incidents.

Chrome users required no manual action because Google deployed immediate browser-side blocks. The company noted that such interventions are not a reliable long-term solution and announced plans to reduce certificate validity periods and DCV reuse through the Chrome Root Program.

Practical Steps for Domain Owners and Registrars

Organizations managing domains under any ccTLD should adopt several verifiable controls. First, set up automated alerts from certificate transparency services such as crt.sh or Cert Spotter to detect new certificates within minutes. Second, publish restrictive CAA records that limit issuance to specific CAs and bind validation to known ACME account URIs. Third, enable any available registry or registrar locks and require multi-factor authentication on all registrar accounts.

Domain owners should also review existing certificates for the affected ccTLDs and request revocation where anomalies appear. Registrars can strengthen security by offering enhanced monitoring services and by pushing customers toward shorter-lived certificates. These measures reduce exposure even when registry-level trust is compromised.

Ongoing investigations have not yet identified the attackers or the full extent of certificate usage. Domain registrar security programs that rely solely on account protections remain incomplete until registry operators publish incident reports and implement stronger access controls.