A certificate authority issues a certificate to whoever can show control of a domain. For a domain under a country registry, that control ultimately runs through the registry. Google said on October 6 that attackers compromised three country-code top-level domains and obtained unauthorized HTTPS certificates for several Google domains.

The certificates are valid. A browser shown one for a Google domain, signed by a certificate authority it trusts, raises no warning. Anyone who can also steer the victim's traffic can sit in the middle of that session and read it, with a padlock on the screen.

The report names .gh and .sl among the three. Google's account of its own position is short: the systems it runs were not the point of entry. Google was the target here. It was not the weak point.

Now take an Asian bank with a regional office registered under .gh or .sl, or under any country registry it has never had reason to contact. Its web login, its mail gateway and its API endpoints carry certificates that depend on a registry run by people the bank's third-party risk team has not assessed. The vendor register lists the cloud provider and the managed security service. It does not list the registry.

The administrator who owns that .sl or .gh domain has one place to look this morning: the public Certificate Transparency logs, which record every certificate a trusted authority issues. A certificate for their hostname, dated around the compromise, that nobody in the company ordered, is the finding. If the logs are clean, that is also the finding, and it costs ten minutes.

The control that changes the outcome is a Certification Authority Authorization record on the domain, restricting issuance to the one authority the company uses, paired with an alert on new entries in the transparency logs. It does not stop a registry compromise. It narrows which authority the attacker has to persuade, and it turns an undetected certificate into a ticket.