China Outrage At Google Digital Certificate Rejection

Has Google quietly served up some long-awaited revenge on Chinese authorities? That is the million dollar question after it emerged that the search engine is now rejecting Chinese digital certificates.

It comes after Google concluded an investigation into the certificates issued by the China Internet Network Information Centre (CNNIC). It is responsible for administering China’s Internet by allocating and certifying IP addresses and web domain names.

Google’s decision effectively means that its products, including Google Chrome, will stop trusting Chinese Websites.

Chinese Outage

Google’s decision to reject the digital certificates was revealed on its security blog. The company reported earlier this week that it became aware of “unauthorised digital certificates for several Google domains.”

The problem is that the Chinese agency issued an intermediate certificate to one of its customers, a Cairo-based networking and security company called MCS Holdings, which in turn issued unauthorised certificates for the Google domains.

That meant connections between browsers and those websites became vulnerable to ‘man-in-the-middle’ hacking attacks, Google said.

“As a result of a joint investigation of the events surrounding this incident by Google and CNNIC, we have decided that the CNNIC Root and EV CAs will no longer be recognized in Google products,” said Google in a blog posting update about the security lapse with the CNNIC digital certificates.

“This will take effect in a future Chrome update,” said Google. “We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.”

What Google’s decision means in reality is that Chrome browser users may get a warning when attempting to visit websites certified by CNNIC.

Unacceptable Decision

Predictably, CNNIC is not all happy about Google’s decision, labeling it “unacceptable and unintelligible.”

“The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration,” said CNNIC on its website.

But CNNIC cannot just be angry at Google.

According to Reuters, the makers of two other web browsers (Microsoft and Mozilla) have now also removed trust of those unauthorised certificates.

Google of course has a very fraught relationship with China. Most of its services are routinely blocked in China for example. In 2010 Google accused Chinese-based hackers of carrying out attacks on the Gmail accounts of human rights activists.

That triggered a huge political row between America and China, and resulted in Google effectively retreating from the Chinese market after refusing to abide by its censorship rules.

Are you a security pro? Try our quiz!