Attackers who hijacked the operators of three country-code domains obtained HTTPS certificates for Google domains, Google disclosed. The company says the issuing CAs did nothing wrong, so its defence came after issuance, and it cannot promise it found every affected domain.
Perspective Coverage
8 publishers
- Builder
- Builder 24%
- Operator
- Operator 69%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+15
- Incentives40
- Confidence68
buildOne report1 publisher Meta's public time service now speaks NTS, so devices can verify time delivered over NTP, a protocol unauthenticated since 1985. Unattended certificate renewals and token checks all read that clock, so a forged reply on plain NTP can break them without anyone noticing.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+5
- Incentives35
- Confidence55
buildOne report1 publisher Public certificate authorities have capped TLS certificates at 200 days since 15 March 2026, falling to 47 days in March 2029. Renewal at that pace has to run unattended, and its failures show up only in the certificate a visitor's browser receives.
Reality
- Evidence50
- Adoption80
- Hype gap+10
- Incentives70
- Confidence55
DigiCert's survey of IT and security leaders puts a price on the outages that certificate expiry already causes, and it shows how unevenly enterprises are preparing for the 47-day deadline in 2029.
Reality
- Evidence42
- Adoption28
- Hype gap+18
- Incentives82
- Confidence46
Thales's Imperva is shipping a connector for DigiCert's lifecycle manager. The deadline that makes it necessary belongs to the CA/Browser Forum, not to any vendor.
Reality
- Evidence34
- Adoption14
- Hype gap+32
- Incentives90
- Confidence33
ACM stops offering email validation in new Regions on Jan 1 2027, blocks new requests on March 31, and stops renewing on Sept 30. The in-place switch to DNS keeps the certificate ARN.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+5
- Incentives55
- Confidence62