Google drops support for Chinese internet security certificates after trust breach

Search giant says it will no longer recognise certificates issued by CNNIC

Reading Time:2 minutes

Google has said it will no longer recognise internet security certificates issued by the official China Internet Network Information Centre. Photo: EPA

Published: 10:15am, 2 Apr 2015Updated: 10:56am, 16 Apr 2015

Search giant Google will no longer recognise security certificates issued by the official China Internet Network Information Centre (CNNIC) following what experts called a "major breach of public trust and confidence".

CNNIC, which is responsible for internet affairs under the Ministry of Industry and Information Technology, responded to Google's announcement with a defence of its practices, calling the move "unacceptable".

Last month, CNNIC issued security certificates for a number of domains, including Google's, without their permission. Security certificates are akin to a website or online service's fingerprint, and tell a browser whether it can be trusted. By issuing unapproved certificates, CNNIC risked compromising the encryption protocols used to protect users of email services and other secure websites.

"CNNIC is included in all major root stores and so the misissued certificates would be trusted by almost all browsers and operating systems," Google said in a statement.

Chinese officials told Google they had contracted Cairo-based MCS Holdings to issue the certificates. MCS said it would only issue certificates for domains it had registered.

"However, rather than keep the private key in a suitable [hardware security module], MCS installed it in a man-in-the-middle proxy. These devices intercept secure connections by masquerading as the intended destination and are sometimes used by companies to intercept their employees' secure traffic for monitoring or legal reasons," Google said.

Tom Lowenthal, a security and surveillance expert at the Committee to Protect Journalists, said the Chinese move marked a "major breach of public trust and confidence". "The deliberate breach had the potential to seriously endanger vulnerable users, such as journalists communicating with sources," he wrote.