DigiNotar Breach Enabled Rogue Google Certificates and Man-in-the-Middle Attacks

Google reported that it detected and blocked an attempted man-in-the-middle campaign after attackers used a fraudulent certificate for google.com, allowing interception of users' connections to Google services. The certificate was traced to Dutch certificate authority DigiNotar, whose systems had been compromised, and the attack reportedly affected hundreds of thousands of users, primarily in Iran. Google said Chrome's built-in certificate checks helped expose the issue after a user encountered Gmail certificate warnings.

Subsequent reporting found that attackers exploited unpatched DigiNotar systems and generated at least 531 rogue certificates, turning the breach into a major failure of the internet's certificate trust model. The Dutch government assumed control of DigiNotar, browser vendors revoked trust in its certificates, and the company ultimately collapsed. The incident became a catalyst for stronger certificate authority controls and broader adoption of defenses including certificate pinning and Certificate Transparency.