5 Certificates Gone Rogue: The DigiNotar Compromise and the Internet's Fragile Trust Infrastructure

The first outward sign that something was wrong came on Saturday, August 27, 2011, and seemed fairly innocuous: a user in Iran couldn't check his Google Mail account. Strangely, when he connected to a Virtual Private Network that disguised his location, the problem disappeared. Whatever was going on, it seemed only to affect computers in Iran. Concerned that the problem might be tied to the Iranian government or his local Internet service provider, the user posted a question about the issue to the Gmail Help Forum under the username alibo. Two days later, Google responded with a public statement about the incident, attributing it to security problems at a Dutch company, DigiNotar. Five days after that, the Dutch government seized control of DigiNotar. On September 20, 2011, less than a month after alibo's post, DigiNotar was declared bankrupt, and the company was liquidated shortly thereafter.