Skip to main content

Google denounces China's internet certificate authority

Google has removed the China Internet Network Information Centre (CNNIC) certificates for websites, claiming a large security threat created by Cairo-based MCS Holdings allowed various unauthorised certificates into the public domain.

The threat has forced Google to revoke CNNIC’s certification privileges, something the internet regulator is not taking easily. It slammed Google decision, stating "The decision that Google has made is unacceptable and unintelligible," on the agency’s website.

Microsoft and Mozilla have both backed Google’s certification ban, meaning over 90 per cent of web browser providers will not recognise the CNNIC certificates as real authentication. This might cripple the Chinese internet for some time, as most companies sign up domains through the internet regulator.

CNNIC and MCS Holdings both claim it was a human error that allowed these unauthorised certificates to be pushed onto Google’s domain, but it doesn’t look like Google will reinstate CNNIC, without some changes to the internet regulator’s security practices.

"While neither we nor CNNIC believe any further unauthorised digital certificates have been issued, nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network, CNNIC will be working to prevent any future incidents," Google said on Wednesday.

Google also stated that CNNIC were welcome to reapply for verification as soon as the unauthorised certificates were removed from the public domain. Google will hold CNNIC’s certificates as trusted for a limited time, before putting them on a whitelist.

It is a big move by Google to go against the Chinese internet regulator, but with Google Search and Gmail already blocked in the country, it does not have a lot to lose by pushing the regulator for better standards.

Google removed its search engine from China in 2010, citing a growing surveillance and government requests trend. It has not been on the best of terms with China since the incident. In Russia, Google has also pulled engineers out of the country, following a new law to store all Russia data on government built servers.

In other areas of the world, Google faces similar struggles with governments, including in Spain where the continued ban of Google News is in effect. Across Europe, a new anti-trust lawsuit is being created against Google for its search dominance and ‘right to be forgotten’ laws.