Google Reports Unauthorized Digital CertificatesGoogle Reports Unauthorized Digital Certificates
Google tracks down unauthorized digital certificate, blocks intermediate certificate authority
December 10, 2013
Google has discovered unauthorized digital certificates being used for several Google domains.
According to a blog on the Google website, the certificates were issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority.
"Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate," the blog states.
Google immediately updated Chrome's certificate revocation metadata to block the intermediate CA, and then alerted ANSSI and other browser vendors.
"ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network," the blog states. "This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers."
Google said the incident "represents a serious breach," and the search engine company is still considering what other actions may need to be taken.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023