Hackers obtain counterfeit TLS certificates for Google and other large services

This sounds like something that HPKP ( https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning ) could have prevented and CAA records ( https://letsencrypt.org/docs/caa/ ) could not. But HPKP is deprecated.

So looks like

1) Top level CC DNS entries were hacked

2) CAA entries were removed (I assume google had them -- they do now CAA 0 issue "pki.goog"

3) These were then used to verify issuing certificates against major CAs (letsencrypt etc) - for example by creating a new CNAME record for DNS verification

Looking at google.as specifically shows Let's Encrypt issuing a certificate on 2026-09-27

https://ctlogs.dev/search?q=google.as

Google normally issues certificates with "Google Trust Services", presumably their in house CA which all browsers trust, but the only way to limit issuing to Google is with the CAA record.

If you hijack DNS, you hijack certificate issuing. As several CAs exist with no business relationship to identify the real person asking for the certificate, you can do this anonymously. (If CAs required verification then you'd just have to chain this with the stolen credentials of someone who uses that CA so wouldn't be a major obstacle)

From what I can tell (and the article conflates this with the diginoir so implies it), this was NOT a compromise of a Certificate Authority

The affected country ccTLDs are:

AS: American Samoa

GH: Greenland

SL: Sierra Leone

[flagged]

From the Google blog "Chrome's Response to Recent ccTLD Registry Hijacks":

"These incidents did not involve a compromise of Google’s systems; rather, attackers compromised the third-party ccTLDs, putting any domain ending in .gh, .sl, or .as at risk. During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations."

So entire top level domain registries were compromised. Interesting times. Isn't there really any primary source on this?

This seems like bullshit given certificate pinning and other countermeasures here. What am I missing ?

Is it TLDs lacking support for this?