Google Reports Unauthorized Digital Certificates
Google tracks down unauthorized digital certificate, blocks intermediate certificate authority
Google has discovered unauthorized digital certificates being used for several Google domains.
According to a blog on the Google website, the certificates were issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority.
"Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate," the blog states.
Google immediately updated Chrome's certificate revocation metadata to block the intermediate CA, and then alerted ANSSI and other browser vendors.
"ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network," the blog states. "This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers."
Google said the incident "represents a serious breach," and the search engine company is still considering what other actions may need to be taken.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Securing Tomorrow, Today: How to Navigate Zero Trust
Nov 13, 2024The State of Attack Surface Management (ASM), Featuring Forrester
Nov 15, 2024Applying the Principle of Least Privilege to the Cloud
Nov 18, 2024The Right Way to Use Artificial Intelligence and Machine Learning in Incident Response
Nov 20, 2024Safeguarding GitHub Data to Fuel Web Innovation
Nov 21, 2024