How do I check if my domain certificate was hijacked?

Spotlight

PAGE: https://alison.com/course/introduction-to-multiple-domain-hosting-on-one-virtual-server

PROMISE: Verify that multiple domains on one server maintain trusted SSL chains and correct DNS configuration.

WHO: System administrators managing multiple domains on a shared DigitalOcean droplet

WHYNOW: Hijacking reports require immediate verification of infrastructure and certificate trust.

DESC: Expand your knowledge of virtual machines and servers and learn how to configure Apache, MySQL, PHP and PhpMyAdmin on the DigitalOcean platform.

BEFORE: Multiple domains share one IP and one server

BEFORE: DNS records may be manipulated by hijackers

BEFORE: SSL trust chains are hard to verify individually

AFTER: Each domain has a distinct virtual host configuration

AFTER: Name server changes are tracked at the registrar level

AFTER: Let’s Encrypt certificates are managed per domain

GAIN: Ability to audit name server settings on registrars to spot hijacks

GAIN: Clear process for configuring virtual hosts for individual domains

GAIN: Method for deploying and testing SSL certificates with Let’s Encrypt

STEP: A registry hijack alters your name servers but your sites remain up with broken trust. || Analyze the management of the name server on our domain registrars admin panel || The reader audits registrar settings to ensure name servers point to the correct infrastructure.

STEP: Certificate renewal fails because the virtual host configuration for specific domains is unclear. || Identify the process for the configuration of a virtual host on our server for each domain || The reader maps each domain to its specific virtual host file to isolate trust chain issues.

STEP: Browsers show insecure warnings even after checking the IP address of the host server. || Describe how to multiple domains on a single server with SSL certificates using Let’s Encrypt || The reader confirms Let’s Encrypt certificates are issued and linked correctly for each site.

NOTFOR: Users who only host a single static website

NOTFOR: Beginners unfamiliar with command line interfaces or Apache

FACT: Average duration: 4-5 Hours (Contains Video)

FACT: CPD-accredited certificate available

FACT: Advanced level

COVERS: Discuss how to create and attach floating IPs to DigitalOcean droplets

COVERS: Recall how to create the directory structure for hosting multiple sites on a single server

COVERS: Outline the installation process for MySQL and PHP

COVERS: Describe how to navigate the DigitalOcean admin panel

COVERS: Recall how to deploy Ubuntu 18.04 on a virtual server

COVERS: State the reasons for hosting multiple domains on one virtual server

COVERS: Identify the process for the configuration of a virtual host on our server for each domain

COVERS: Discuss the configuration of a DNS zone file, name server and virtual host files to multiple domains on one server

COVERS: Explain how to access and test server configurations through a web proxy

COVERS: Describe how to multiple domains on a single server with SSL certificates using Let’s Encrypt

COVERS: Analyze the management of the name server on our domain registrars admin panel

COVERS: Explain how to modify MySQL authentication methods

MODULE: Installations and Setup || Introduction to Course | Floating IPs | Installing Essential Services

MODULE: Web Server Configuration || Working with Virtual Host | Creating and Enabling Virtual Host File | Securing Domains with SSL

What you are probably seeing

Security alerts flag mismatched certificate chains or unknown issuers in your monitoring dashboard that do not match your intended CA.

Traffic to your site shows intermittent errors in browser console logs because clients reject the forged certificate presented by the hijacked registry.

Why it happens

Attackers exploit weak authentication controls at specific country-code registries to sign fake certificates without proper domain validation.

These forged certificates integrate into public trust stores, causing browsers to attempt validation against compromised registry logs.

What changed recently

2026-10-07 · 📰 **Hackers obtain counterfeit TLS certificates for Google and other large services** Compromise of 3 domain registries allows hackers to walk off with unauthorized certs. 📰 Source: Ars Technica
Security teams are now auditing those gaps:
• .gh, .sl, and .as registries were compromised.
• Fake Google TLS certificates were issued.
• Unauthorized HTTPS certificates were obtained.
Source: bluesky

Step by step

1. Check the Certificate Transparency logs to identify any unauthorized certificate issuance events for your domain name.

2. Verify your domain registry status with the specific registry operator to confirm if their infrastructure was part of the compromise.

3. Revoke any suspicious certificates and request reissuance from a trusted, unaffected certificate authority immediately.

4. Update your internal security documentation to list the compromised registries and flag any domains hosted there for review.

5. Configure your monitoring tools to alert on any future certificate changes for your domain to catch tampering early.

Ways to go further

Start here: Beginner in Multiple Domain Hosting on One Virtual Server For when you host multiple domains on one server and need to understand infrastructure. Open the free course on Alison ↗

Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.

Other problems readers raise

How to enforce MFA on Microsoft 365 and Google accounts

How to keep your AI content safe from platform crackdowns

How to check if your new tools export your data

How to check if your email was in the ASOS breach list

Is your mail gateway vulnerable to unauthenticated path traversal?