Kazakhstan man-in-the-middle attack

In 2015, the government of Kazakhstan created a root certificate which could have enabled a man-in-the-middle attack on HTTPS traffic from Internet users in Kazakhstan. The government described it as a "national security certificate". If installed on users' devices, the certificate would have allowed the Kazakh government to intercept, decrypt, and re-encrypt any traffic passing through systems it controlled.[1][2]

In July 2019, Kazakh ISPs started messaging their users that the certificate, now called the Qaznet Trust Certificate,[3] issued by the state certificate authority the Qaznet Trust Network, would now have to be installed by all users.[4][5][6]

Sites operated by Google, Facebook and Twitter appear to be among the Kazakh government's initial targets.[7]

On August 21, 2019, Mozilla and Google simultaneously announced that their Firefox and Chrome web browsers would not accept the government-issued certificate, even if installed manually by users.[8][9] Apple also announced that they would make similar changes to their Safari browser.[7] As of August 2019, Microsoft has so far not made any changes to its browsers, but reiterated that the government-issued certificate was not in the trusted root store of any of its browsers, and would not have any effect unless a user manually installed it.[10]

In December 2020, the Kazakh government attempted to re-introduce the government-issued root certificate for a third time.[11] In response to this, browser vendors again announced that they would block any such attempt by invalidating the certificate in their browsers.[12]