DigiNotar Certificate Authority Breach
Total compromise of Dutch CA issuing 500+ rogue wildcard SSL certs
Incident Overview
In July 2011, attackers breached DigiNotar, a Dutch Certificate Authority. They issued rogue wildcard certificates for major domain names, allowing man-in-the-middle attacks on web users.
Real-World Impact
Rogue *.google.com certificate was used to intercept web traffic of 300,000+ Iranian Internet users. DigiNotar declared bankruptcy.
Technical Root Cause Analysis
Hackers compromised DigiNotar internal network servers, gained access to root CA private keys, and issued unauthorized SSL certificates for google.com, microsoft.com, and intelligence agencies.
- Wildcard Certificate Issuance: Issued `*.google.com` certificate matching all Google web services.
- Chrome Certificate Pinning: Chrome hardcoded Google domain public keys. When Chrome detected a DigiNotar-signed Google cert, it blocked the connection.
- Birth of Certificate Transparency: Event spurred RFC 6962 Certificate Transparency (CT) requiring public log auditability.
Rogue Certificate Audit Log Entry
{
"subject": "CN=*.google.com, O=Google Inc",
"issuer": "CN=DigiNotar Root CA, O=DigiNotar",
"validFrom": "2011-07-10T19:00:00Z",
"fingerprintSHA1": "0A:6F:68:59:E8:29:F6:DA:5B:3F:8A:2F:E9:9D:4F"
}Incident Timeline
Rogue wildcard certificate for *.google.com issued by DigiNotar root CA.
Iranian user posts on Google forum reporting SSL warning in Chrome.
Google Chrome triggers hardcoded certificate pin violation.
Dutch government assumes control of DigiNotar; root CA revoked globally.
DigiNotar files for bankruptcy.
Key Engineering Takeaway & Defensive Guidance
Implement HTTP Public Key Pinning (HPKP), Certificate Transparency (CT) logs, and strict multi-factor access for Root CAs.