Virtual Event Today: Cyber AI & Automation Summit - Register/Login Now
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Data Protection

Google Launches Its Own Root Certificate Authority

Google announced on Thursday the expansion of its certificate authority (CA) efforts with the launch of a root CA that will allow the company to independently handle its certificate needs.

Google announced on Thursday the expansion of its certificate authority (CA) efforts with the launch of a root CA that will allow the company to independently handle its certificate needs.

The company has been on the frontline of efforts to make the Internet safer by getting all web services to use HTTPS, including by boosting secure pages in search results and by tracking the use of HTTPS on the world’s top 100 websites.

Google has been operating the subordinate certificate authority GIAG2, signed by the GeoTrust Global CA, and the next step is to gain the ability to issue root certificates for products on its own. The new entity responsible for operating the CAs on behalf of Google and Alphabet is Google Trust Services.

Google Trust Services

In an effort to start issuing certificates as soon as possible, Google has decided to acquire two existing root CAs, namely GlobalSign R2 and R4. The company will also continue to use its GIAG2 certificate authority as it transitions to an independent infrastructure.

“If you are building products that intend to connect to a Google property moving forward you need to at minimum include the above Root Certificates. With that said even though we now operate our own roots, we may still choose to operate subordinate CAs under third-party operated roots,” Ryan Hurst, security and privacy engineer at Google, said in a blog post. “For this reason if you are developing code intended to connect to a Google property, we still recommend you include a wide set of trustworthy roots.”

Commenting on Hacker News, some applauded Google’s decision, while others pointed out that the search giant is gaining more and more control over the Internet.

Over the past years, Google has identified several CAs that had issued unauthorized certificates for its domains. The list includes the China Internet Network Information Center (CNNIC), India’s National Informatics Center (NIC), Turkish firm TURKTRUST, and Symantec.

Last year, the company announced the introduction of a new Certificate Transparency (CT) log for CAs that have been removed from trusted root programs.

Advertisement. Scroll to continue reading.

Related Reading: Facebook Launches Certificate Transparency Monitoring Tool

Related Reading: Let’s Encrypt Issues More Than 1 Million Digital Certificates

Related Reading: Amazon Offers Free SSL/TLS Certificate

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.

Register

As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Data Protection

The cryptopocalypse is the point at which quantum computing becomes powerful enough to use Shor’s algorithm to crack PKI encryption.

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...

Artificial Intelligence

The CRYSTALS-Kyber public-key encryption and key encapsulation mechanism recommended by NIST for post-quantum cryptography has been broken using AI combined with side channel attacks.

CISO Conversations

In this issue of CISO Conversations we talk to two CISOs about solving the CISO/CIO conflict by combining the roles under one person.

CISO Strategy

Security professionals understand the need for resilience in their company’s security posture, but often fail to build their own psychological resilience to stress.