DigiNotar: the company that vouched for fake websites

The story

When a website shows a padlock, it is presenting a certificate: a digital document saying the site really belongs to its owner. Certificates are issued by a small number of companies that browsers trust, called certificate authorities.

DigiNotar was one of them, based in the Netherlands. In June 2011, attackers broke into its systems. Over the following weeks they issued hundreds of fake certificates, including one for Google’s domains.

The fake Google certificate was used to intercept the email of people in Iran. An investigation found that about 300,000 Iranian users of Gmail were the main target. To those users, everything looked normal: the right address and a padlock.

The breach came to light when a user in Iran noticed a warning from the Chrome browser, which had extra checks for Google’s own certificates. Browser makers then removed DigiNotar from their trusted lists. The Dutch government took over its systems, and in September 2011 the company was declared bankrupt.

Why it mattered

It showed that the padlock is only as trustworthy as every company allowed to issue certificates. One break-in at one of them put users of a major email service at risk, and the company did not survive the loss of trust. European security agencies called for deeper reform of how website certificates are trusted.

The lesson today

The padlock means the connection is encrypted and that a trusted company vouched for the site. It says nothing about whether the site is honest. Treat it as one sign among several, and keep browsers updated, because that is how bad certificates get blocked.