Google Reports Unauthorized Digital Certificates
Google has discovered unauthorized digital certificates being used for several Google domains.
According to a blog on the Google website, the certificates were issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority.
“Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate,” the blog states.
Google immediately updated Chrome’s certificate revocation metadata to block the intermediate CA, and then alerted ANSSI and other browser vendors.
“ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network,” the blog states. “This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers.”
Google said the incident “represents a serious breach,” and the search engine company is still considering what other actions may need to be taken.
Have a comment on this story? Please click “Add a Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.
Article source: http://www.darkreading.com/end-user/google-reports-unauthorized-digital-cert/240164601