Google is now operating its own Root Certificate Authority to increase product security

Noting the foundational importance of HTTPS in the evolution of the web going forward, Google is now operating its own Root Certificate Authority. Responsible for authenticating the identity of websites, Google Trust Services will operate certificates on behalf of Google and Alphabet.

The company has already been operating its own subordinate Certificate Authority (GIAG2) to more rapidly handle the SSL/TLS certificate needs of its products. Google is now expanding on those efforts with its own Root Certificate Authority.

With Google Trust Services, the company is taking ownership of the highest level in the security structure used to authenticate a website’s identity. Specifically, it is used to sign other subordinate certificates. Google’s current ones have been issued by a third-party and will continue to be operated to hasten the transition to an independent structure.

To further speed up the process of embedding Root Certificates into products, Google is purchasing two existing Root Certificate Authorities, GlobalSign R2 and R4. These acquisitions will allow “independent certificate issuance sooner rather than later.”

End users should not see a disruption, but developers building products that interact with Google services will have to include the new Root Certificates. For more information, developers can head to https://pki.goog.