In early October, attackers successfully compromised the authoritative DNS and certificate infrastructure for three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). The breach allowed them to generate valid HTTPS certificates for Google domains and potentially any other target within those TLDs. While Google's own systems remained intact, the incident exposes a systemic vulnerability in how ccTLD registries are managed globally.
How Registry Compromise Enables Certificate Fraud
The attack relied on a chain of dependencies that most infrastructure operators take for granted. A ccTLD registry operates authoritative nameservers for all domains under that TLD. If an attacker gains control of those servers, they can redirect any domain's DNS queries to a server they control. With DNS authority in hand, they can then satisfy the validation challenges used by certificate authorities during the issuance process.
Public CAs like Let's Encrypt and others rely on DNS-01 validation for domain ownership verification. The process works like this: you prove control of a domain by adding a specific TXT record to its DNS zone. If an attacker controls the authoritative nameserver for .gh, .sl, or .as, they can respond to those validation queries with any value they choose. To a CA, it looks legitimate. The certificate gets issued.
This is not a flaw unique to any single CA or validation method. It is a fundamental property of how DNS and certificates interact. Compromise the registry, and you compromise every domain registered beneath it.
The Scope of Exposure
The immediate damage in this case was contained to Google's need to revoke and reissue certificates. However, the exposure period matters. If attackers obtained certificates days or weeks before detection, they could have performed man-in-the-middle attacks against any user attempting to visit a Google service via a .gh, .sl, or .as domain (or more likely, redirects masquerading as Google domains to users in affected regions).
For smaller registries—particularly those with limited security budgets or legacy infrastructure—the risk is even higher. A ccTLD registry in a smaller nation may not have the same monitoring, incident response, or infrastructure hardening as a major global operator. Compromises could go undetected longer, or recovery could be severely delayed.
Operator Responsibilities and Hardening
If you operate a domain registry or manage nameservers for a ccTLD, several practices reduce this risk, though none eliminate it entirely. Access controls to registry systems must be strict and logged. Administrative credentials should be hardened with multi-factor authentication. DNS zone transfers should be restricted to authorised systems. Regular audits of zone changes and certificate issuance requests (if you log them) can catch anomalies early.
For domain owners registering under at-risk TLDs, the attack surface is harder to shrink unilaterally. Certificate Transparency (CT) logs provide visibility into issued certificates, and monitoring those logs for your domains is essential. Some registrars and domain management platforms offer automated CT monitoring. If you see unexpected certificates, notification of your CA and a revocation request should follow immediately.
The Broader Infrastructure Fragility
This incident underscores a deeper truth: the DNS and certificate ecosystem is only as secure as its weakest operator. A compromised ccTLD registry can undermine security guarantees that major platforms like Google invest heavily to maintain. There is no technical fix that allows individual operators to fully isolate themselves from registry-level compromise.
CAs have experimented with additional mitigations—such as requiring DNSSEC signatures before issuing certificates, or restricting high-value domains to manual review. However, these approaches add friction and are not universally deployed. The long-term answer likely involves stronger registry infrastructure standards, better incident disclosure, and perhaps regulatory requirements for ccTLD operators globally.
Until then, operators managing domains across multiple TLDs should assume that registry compromise is possible and implement detective controls: monitor certificate issuance, log DNS changes, and maintain alerting for anomalies. The integrity of your infrastructure depends on it.
