When DNS Trust Breaks: What the Counterfeit Google Certificates Reveal
Akamai Technologies, Thursday, October 22nd, 2026
Akamai explains how attackers hijacked three ccTLD registries to obtain 12 trusted TLS certificates for Google domains.
Akamai says that in late September 2026 attackers took over the .gh, .sl and .as country-code registries and used them to obtain 12 publicly trusted TLS certificates for Google and YouTube domains.
By altering authoritative DNS records, they passed certificate authorities' domain-validation checks without breaching Google or the CAs.
Let's Encrypt issued 11 certificates and ZeroSSL one, and all were revoked by October 1.
Akamai urges organizations to monitor NS delegation, Certificate Transparency logs and CAA policies, and to revoke certificates issued during any DNS compromise.