Loading story…
DigiNotar, a Dutch certificate authority, was compromised and used to issue at least 531 fraudulent SSL certificates for 344 domains, including google.com, enabling spoofing and man-in-the-middle attacks against supposedly secure services. Reporting indicated the fake Google certificate was likely used to intercept Gmail traffic from users in Iran, potentially exposing roughly 300,000 accounts and putting dissidents at risk. The breach was publicly linked to the actor who had claimed responsibility for the earlier Comodo certificate fraud, and it intensified criticism of the certificate authority trust model as incapable of resisting nation-state abuse.
The fallout spread quickly across browsers, operating systems, and government services. Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates, while Microsoft issued advisory 2607712 and updates including KB2607712 and KB2616676 to place DigiNotar certificates in the Windows Untrusted Certificate Store; Safari users were reported to remain exposed for a time. In the Netherlands, the government took over DigiNotar’s operations after investigators found severe security failures, warned that it could not guarantee the safety of its own websites, and shifted trust for public-sector certificates as DigiNotar’s business collapsed into bankruptcy.
See attribution, scope, and your downstream exposure.
14 events from the most recent confirmed update back to the earliest known activity.
Following the collapse of trust in DigiNotar, regulators required revocation of all certificates issued by the company. This effectively ended DigiNotar's certificate authority business.
After losing browser and government trust and seeing its certificate authority business collapse, DigiNotar filed for voluntary bankruptcy in September 2011. The filing marked the final corporate fallout from the breach.
Microsoft rereleased KB2616676 after discovering the earlier package did not fully include certificates from prior updates on Windows XP and Windows Server 2003. The rerelease corrected the trust-removal coverage for those platforms.
Microsoft replaced KB2607712 with KB2616676 to continue removing trust in DigiNotar certificates across Windows systems. The company urged users to install the newer update immediately.
As the breach disrupted trust in government PKI services, the Dutch government took over DigiNotar's operations. Authorities also warned they could no longer guarantee the security of government websites relying on DigiNotar certificates.
Microsoft issued security update KB2607712 to add DigiNotar certificates to the Windows Untrusted Certificate Store. The update was intended to protect supported Windows systems and Internet Explorer users from active attacks using fraudulent DigiNotar certificates.
A hacker previously tied to the Comodo certificate fraud publicly claimed to have also breached DigiNotar and other certificate authorities, including GlobalSign. The claim influenced public attribution of the incident toward the same Iranian actor.
Subsequent investigation found the breach was far worse than initially disclosed: 531 fraudulent certificates had been issued for 344 domain names, and DigiNotar's internal security was severely deficient. The findings deepened the trust crisis around the company.
Google, Microsoft, and Mozilla moved to distrust DigiNotar certificates as the scope of the breach became clearer. Ars Technica also reported that Safari users remained susceptible because Apple had not yet pushed equivalent protections.
Researchers and media reports said the rogue google.com certificate could have been used to monitor dissidents and steal credentials from users in Iran, potentially affecting hundreds of thousands of Gmail accounts. The case intensified criticism of the certificate authority trust model.
Microsoft updated its Certificate Trust List to remove trust from at least one DigiNotar root after learning a fraudulent DigiNotar certificate was being used in active attacks. The company warned the issue enabled spoofing, phishing, and man-in-the-middle attacks.
In August 2011, DigiNotar disclosed that it had been breached and had fraudulently issued SSL certificates, including one for Google. The disclosure triggered broader scrutiny of the certificate authority's security and trustworthiness.
Google released a Chrome update with certificate pinning protection that helped block misuse of the fraudulent DigiNotar google.com certificate. This reduced exposure for Chrome users compared with other browsers.
DigiNotar issued a rogue SSL certificate for google.com, later linked to man-in-the-middle attacks against Google services. Reporting said the certificate was created on 2011-07-10 and was particularly dangerous for users in Iran.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
technet.microsoft.com
Open sourcespectrum.ieee.org
Open sourcearstechnica.com
Open sourcearstechnica.com
Open sourcetheguardian.com
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google reported that it detected and blocked an attempted man-in-the-middle campaign after attackers used a fraudulent certificate for `google.com`, allowing interception of users' connections to Google services. The certificate was traced to Dutch certificate authority DigiNotar, whose systems had been compromised, and the attack reportedly affected hundreds of thousands of users, primarily in Iran. Google said Chrome's built-in certificate checks helped expose the issue after a user encountered Gmail certificate warnings. Subsequent reporting found that attackers exploited unpatched DigiNotar systems and generated at least **531 rogue certificates**, turning the breach into a major failure of the internet's certificate trust model. The Dutch government assumed control of DigiNotar, browser vendors revoked trust in its certificates, and the company ultimately collapsed. The incident became a catalyst for stronger certificate authority controls and broader adoption of defenses including **certificate pinning** and **Certificate Transparency**.
Aug 4, 2026
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign **Zhong Stealer** malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks. The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4** certificates as `Trojan:Win32/Cerdigent.A!dha`. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version `.430` cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Jul 20, 2026
A faulty Microsoft Defender signature update released on April 30 incorrectly detected legitimate DigiCert root certificates as `Trojan:Win32/Cerdigent.A!dha`, triggering alerts across Windows environments and, in some cases, quarantining or removing trusted roots from stores such as **AuthRoot**. The flagged thumbprints were tied to valid DigiCert trust anchors, including **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4**, causing administrators and SOC teams to suspect compromise and disrupting certificate trust relationships used for TLS validation and code signing. Microsoft later acknowledged the detections were erroneous and remediated the issue with updated Defender security intelligence, including version `1.449.430.0` or later. Reporting indicates the overly broad detection logic may have stemmed from Microsoft’s response to a separate DigiCert code-signing certificate incident linked to abuse such as the **Zhong Stealer** campaign, but the certificates flagged in this case were legitimate and not revoked. The false positive prompted some organizations to take unnecessary recovery actions, including system rebuilds, underscoring the operational risk of automated detections that affect root certificate trust stores.
Jun 29, 2026