Google Reports Unauthorized Digital Certificates

Google tracks down unauthorized digital certificate, blocks intermediate certificate authority

Dark Reading Staff, Dark Reading

December 10, 2013

1 Min Read

Google has discovered unauthorized digital certificates being used for several Google domains.

According to a blog on the Google website, the certificates were issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority.

"Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate," the blog states.

Google immediately updated Chrome's certificate revocation metadata to block the intermediate CA, and then alerted ANSSI and other browser vendors.

"ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network," the blog states. "This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers."

Google said the incident "represents a serious breach," and the search engine company is still considering what other actions may need to be taken.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights